This issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.
" + } + ] + } + ], + "references": [ + { + "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "HIGH", + "vulnIntegrityImpact": "NONE", + "subIntegrityImpact": "HIGH", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "HIGH", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 8.5, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2025/71xxx/CVE-2025-71459.json b/data/2025/71xxx/CVE-2025-71459.json index ed6250e67c..03edfc084c 100644 --- a/data/2025/71xxx/CVE-2025-71459.json +++ b/data/2025/71xxx/CVE-2025-71459.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-11T22:58:40.540Z", "datePublished": "2026-11-13T09:37:02.598Z", - "dateUpdated": "2026-11-13T09:37:02.598Z" + "dateUpdated": "2026-11-13T20:34:31.062Z" }, "containers": { "cna": { @@ -118,6 +118,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:34:21.054650Z", + "id": "CVE-2025-71459", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:34:31.062Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2025/71xxx/CVE-2025-71463.json b/data/2025/71xxx/CVE-2025-71463.json index bc9e7dd488..e50aa4e999 100644 --- a/data/2025/71xxx/CVE-2025-71463.json +++ b/data/2025/71xxx/CVE-2025-71463.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-12T23:12:43.913Z", "datePublished": "2026-11-13T09:36:59.897Z", - "dateUpdated": "2026-11-13T09:36:59.897Z" + "dateUpdated": "2026-11-13T20:35:14.393Z" }, "containers": { "cna": { @@ -140,6 +140,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:34:57.242804Z", + "id": "CVE-2025-71463", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:35:14.393Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/107xxx/CVE-2026-107398.json b/data/2026/107xxx/CVE-2026-107398.json index 2cc72de4e1..a05a326026 100644 --- a/data/2026/107xxx/CVE-2026-107398.json +++ b/data/2026/107xxx/CVE-2026-107398.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-10-07T21:07:54.989Z", "datePublished": "2026-11-13T17:52:33.232Z", - "dateUpdated": "2026-11-13T17:52:33.232Z" + "dateUpdated": "2026-11-13T21:16:37.531Z" }, "containers": { "cna": { @@ -89,6 +89,40 @@ "advisory": "GHSA-h57f-c9j4-577x", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:16:26.920630Z", + "id": "CVE-2026-107398", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:16:37.531Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/107xxx/CVE-2026-107525.json b/data/2026/107xxx/CVE-2026-107525.json index 9f8cc5b381..2009a672e0 100644 --- a/data/2026/107xxx/CVE-2026-107525.json +++ b/data/2026/107xxx/CVE-2026-107525.json @@ -8,7 +8,7 @@ "assignerShortName": "dell", "dateReserved": "2026-10-08T10:04:10.615Z", "datePublished": "2026-11-13T13:08:18.837Z", - "dateUpdated": "2026-11-13T13:08:18.837Z" + "dateUpdated": "2026-11-13T21:00:22.769Z" }, "containers": { "cna": { @@ -279,6 +279,40 @@ "x_generator": { "engine": "Vulnogram 1.0.5" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:00:09.706976Z", + "id": "CVE-2026-107525", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:00:22.769Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/110xxx/CVE-2026-110697.json b/data/2026/110xxx/CVE-2026-110697.json index f6886af271..7d17587713 100644 --- a/data/2026/110xxx/CVE-2026-110697.json +++ b/data/2026/110xxx/CVE-2026-110697.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-14T14:10:16.450Z", "datePublished": "2026-11-11T17:06:13.261Z", - "dateUpdated": "2026-11-13T09:13:00.690Z" + "dateUpdated": "2026-11-13T20:50:43.548Z" }, "containers": { "cna": { @@ -249,6 +249,16 @@ "cpe:/a:redhat:quay:3.9::el8" ] }, + { + "vendor": "Red Hat", + "product": "mirror registry for Red Hat OpenShift 2", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "openshift/mirror-registry-rhel8", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:mirror_registry:2" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Quay 5", @@ -385,7 +395,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-13T09:13:00.690Z" + "dateUpdated": "2026-11-13T20:50:43.548Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/113xxx/CVE-2026-113963.json b/data/2026/113xxx/CVE-2026-113963.json index 1d38bc4109..a8cb8f7d17 100644 --- a/data/2026/113xxx/CVE-2026-113963.json +++ b/data/2026/113xxx/CVE-2026-113963.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2026-10-20T21:06:55.480Z", "datePublished": "2026-11-09T20:27:59.961Z", - "dateUpdated": "2026-11-12T21:46:05.376Z" + "dateUpdated": "2026-11-13T20:33:38.462Z" }, "containers": { "cna": { @@ -47,6 +47,18 @@ } ] }, + { + "vendor": "Apple", + "product": "tvOS", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThan": "27.2.1", + "versionType": "custom" + } + ] + }, { "vendor": "Apple", "product": "visionOS", @@ -75,13 +87,16 @@ "descriptions": [ { "lang": "en", - "value": "An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data." + "value": "An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iPadOS 27.2.1, tvOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data." } ], "references": [ { "url": "https://support.apple.com/en-us/149715" }, + { + "url": "https://support.apple.com/en-us/149721" + }, { "url": "https://support.apple.com/en-us/149722" }, @@ -95,7 +110,7 @@ "providerMetadata": { "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", - "dateUpdated": "2026-11-12T21:46:05.376Z" + "dateUpdated": "2026-11-13T20:33:38.462Z" } }, "adp": [ diff --git a/data/2026/113xxx/CVE-2026-113964.json b/data/2026/113xxx/CVE-2026-113964.json index 96f124a9f2..e88054979b 100644 --- a/data/2026/113xxx/CVE-2026-113964.json +++ b/data/2026/113xxx/CVE-2026-113964.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2026-10-20T21:06:55.480Z", "datePublished": "2026-11-09T20:28:00.168Z", - "dateUpdated": "2026-11-12T21:46:05.600Z" + "dateUpdated": "2026-11-13T20:33:38.671Z" }, "containers": { "cna": { @@ -83,6 +83,18 @@ } ] }, + { + "vendor": "Apple", + "product": "tvOS", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThan": "27.2.1", + "versionType": "custom" + } + ] + }, { "vendor": "Apple", "product": "visionOS", @@ -117,7 +129,7 @@ "descriptions": [ { "lang": "en", - "value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction." + "value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction." } ], "references": [ @@ -139,6 +151,9 @@ { "url": "https://support.apple.com/en-us/149720" }, + { + "url": "https://support.apple.com/en-us/149721" + }, { "url": "https://support.apple.com/en-us/149722" }, @@ -155,7 +170,7 @@ "providerMetadata": { "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", - "dateUpdated": "2026-11-12T21:46:05.600Z" + "dateUpdated": "2026-11-13T20:33:38.671Z" } }, "adp": [ diff --git a/data/2026/113xxx/CVE-2026-113965.json b/data/2026/113xxx/CVE-2026-113965.json index df8d26e790..89d7910af5 100644 --- a/data/2026/113xxx/CVE-2026-113965.json +++ b/data/2026/113xxx/CVE-2026-113965.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2026-10-20T21:06:55.480Z", "datePublished": "2026-11-09T20:28:00.382Z", - "dateUpdated": "2026-11-12T21:46:05.847Z" + "dateUpdated": "2026-11-13T20:33:38.876Z" }, "containers": { "cna": { @@ -83,6 +83,18 @@ } ] }, + { + "vendor": "Apple", + "product": "tvOS", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThan": "27.2.1", + "versionType": "custom" + } + ] + }, { "vendor": "Apple", "product": "visionOS", @@ -117,7 +129,7 @@ "descriptions": [ { "lang": "en", - "value": "This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction." + "value": "This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction." } ], "references": [ @@ -139,6 +151,9 @@ { "url": "https://support.apple.com/en-us/149720" }, + { + "url": "https://support.apple.com/en-us/149721" + }, { "url": "https://support.apple.com/en-us/149722" }, @@ -155,7 +170,7 @@ "providerMetadata": { "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", - "dateUpdated": "2026-11-12T21:46:05.847Z" + "dateUpdated": "2026-11-13T20:33:38.876Z" } }, "adp": [ diff --git a/data/2026/113xxx/CVE-2026-113968.json b/data/2026/113xxx/CVE-2026-113968.json index 8795917454..af5fada01e 100644 --- a/data/2026/113xxx/CVE-2026-113968.json +++ b/data/2026/113xxx/CVE-2026-113968.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2026-10-20T21:06:55.481Z", "datePublished": "2026-11-09T20:28:00.591Z", - "dateUpdated": "2026-11-12T21:46:06.082Z" + "dateUpdated": "2026-11-13T20:33:39.072Z" }, "containers": { "cna": { @@ -83,6 +83,18 @@ } ] }, + { + "vendor": "Apple", + "product": "tvOS", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThan": "27.2.1", + "versionType": "custom" + } + ] + }, { "vendor": "Apple", "product": "visionOS", @@ -117,7 +129,7 @@ "descriptions": [ { "lang": "en", - "value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts." + "value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts." } ], "references": [ @@ -139,6 +151,9 @@ { "url": "https://support.apple.com/en-us/149720" }, + { + "url": "https://support.apple.com/en-us/149721" + }, { "url": "https://support.apple.com/en-us/149722" }, @@ -155,7 +170,7 @@ "providerMetadata": { "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", - "dateUpdated": "2026-11-12T21:46:06.082Z" + "dateUpdated": "2026-11-13T20:33:39.072Z" } }, "adp": [ diff --git a/data/2026/113xxx/CVE-2026-113969.json b/data/2026/113xxx/CVE-2026-113969.json index 5351d03573..de2e11acbc 100644 --- a/data/2026/113xxx/CVE-2026-113969.json +++ b/data/2026/113xxx/CVE-2026-113969.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2026-10-20T21:06:55.481Z", "datePublished": "2026-11-09T20:28:00.897Z", - "dateUpdated": "2026-11-12T21:46:06.315Z" + "dateUpdated": "2026-11-13T20:33:39.313Z" }, "containers": { "cna": { @@ -83,6 +83,18 @@ } ] }, + { + "vendor": "Apple", + "product": "tvOS", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThan": "27.2.1", + "versionType": "custom" + } + ] + }, { "vendor": "Apple", "product": "visionOS", @@ -117,7 +129,7 @@ "descriptions": [ { "lang": "en", - "value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts." + "value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts." } ], "references": [ @@ -139,6 +151,9 @@ { "url": "https://support.apple.com/en-us/149720" }, + { + "url": "https://support.apple.com/en-us/149721" + }, { "url": "https://support.apple.com/en-us/149722" }, @@ -155,7 +170,7 @@ "providerMetadata": { "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", - "dateUpdated": "2026-11-12T21:46:06.315Z" + "dateUpdated": "2026-11-13T20:33:39.313Z" } }, "adp": [ diff --git a/data/2026/113xxx/CVE-2026-113970.json b/data/2026/113xxx/CVE-2026-113970.json index b0425f914c..c390890136 100644 --- a/data/2026/113xxx/CVE-2026-113970.json +++ b/data/2026/113xxx/CVE-2026-113970.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2026-10-20T21:06:55.481Z", "datePublished": "2026-11-09T20:28:01.101Z", - "dateUpdated": "2026-11-12T21:46:06.547Z" + "dateUpdated": "2026-11-13T20:33:39.523Z" }, "containers": { "cna": { @@ -83,6 +83,18 @@ } ] }, + { + "vendor": "Apple", + "product": "tvOS", + "versions": [ + { + "version": "0", + "status": "affected", + "lessThan": "27.2.1", + "versionType": "custom" + } + ] + }, { "vendor": "Apple", "product": "visionOS", @@ -117,7 +129,7 @@ "descriptions": [ { "lang": "en", - "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory." + "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory." } ], "references": [ @@ -139,6 +151,9 @@ { "url": "https://support.apple.com/en-us/149720" }, + { + "url": "https://support.apple.com/en-us/149721" + }, { "url": "https://support.apple.com/en-us/149722" }, @@ -155,7 +170,7 @@ "providerMetadata": { "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", - "dateUpdated": "2026-11-12T21:46:06.547Z" + "dateUpdated": "2026-11-13T20:33:39.523Z" } }, "adp": [ diff --git a/data/2026/114xxx/CVE-2026-114713.json b/data/2026/114xxx/CVE-2026-114713.json index 70c0ad3f0d..2b79a20ee4 100644 --- a/data/2026/114xxx/CVE-2026-114713.json +++ b/data/2026/114xxx/CVE-2026-114713.json @@ -8,7 +8,7 @@ "assignerShortName": "mitre", "dateReserved": "2026-10-22T00:56:41.381Z", "datePublished": "2026-11-08T02:31:48.387Z", - "dateUpdated": "2026-11-13T19:25:14.456Z" + "dateUpdated": "2026-11-13T20:58:23.501Z" }, "containers": { "cna": { @@ -182,6 +182,15 @@ "timestamp": "2026-11-13T19:16:29.356444Z" } } + }, + { + "other": { + "type": "kev", + "content": { + "dateAdded": "2026-11-13", + "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713" + } + } } ], "references": [ @@ -196,8 +205,15 @@ "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", - "dateUpdated": "2026-11-13T19:25:14.456Z" - } + "dateUpdated": "2026-11-13T20:58:23.501Z" + }, + "timeline": [ + { + "time": "2026-11-13T00:00:00.000Z", + "lang": "en", + "value": "CVE-2026-114713 added to CISA KEV" + } + ] } ] } diff --git a/data/2026/116xxx/CVE-2026-116323.json b/data/2026/116xxx/CVE-2026-116323.json index aa14ef3101..b87155d597 100644 --- a/data/2026/116xxx/CVE-2026-116323.json +++ b/data/2026/116xxx/CVE-2026-116323.json @@ -8,7 +8,7 @@ "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T03:52:44.053Z", "datePublished": "2026-11-12T14:15:13.913Z", - "dateUpdated": "2026-11-12T14:15:13.913Z" + "dateUpdated": "2026-11-13T20:28:25.137Z" }, "containers": { "cna": { @@ -106,6 +106,40 @@ "value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem." } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:28:12.666825Z", + "id": "CVE-2026-116323", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:28:25.137Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/116xxx/CVE-2026-116326.json b/data/2026/116xxx/CVE-2026-116326.json index 980f454eb6..3d579f94ae 100644 --- a/data/2026/116xxx/CVE-2026-116326.json +++ b/data/2026/116xxx/CVE-2026-116326.json @@ -8,7 +8,7 @@ "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T03:52:44.053Z", "datePublished": "2026-11-12T14:15:15.067Z", - "dateUpdated": "2026-11-12T14:15:15.067Z" + "dateUpdated": "2026-11-13T20:27:12.458Z" }, "containers": { "cna": { @@ -106,6 +106,40 @@ "value": "The PostgreSQL project thanks Dwij Mehta, Ngoc Trần, and Anthropic OSS program for reporting this problem." } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:26:46.216443Z", + "id": "CVE-2026-116326", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:27:12.458Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/116xxx/CVE-2026-116328.json b/data/2026/116xxx/CVE-2026-116328.json index e0c3be494b..0dfba6c994 100644 --- a/data/2026/116xxx/CVE-2026-116328.json +++ b/data/2026/116xxx/CVE-2026-116328.json @@ -8,7 +8,7 @@ "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T03:52:44.054Z", "datePublished": "2026-11-12T14:15:16.239Z", - "dateUpdated": "2026-11-12T14:15:16.239Z" + "dateUpdated": "2026-11-13T20:25:16.827Z" }, "containers": { "cna": { @@ -88,6 +88,40 @@ "value": "The PostgreSQL project thanks Jayden Sarveshkumar for reporting this problem." } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:24:56.822534Z", + "id": "CVE-2026-116328", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:25:16.827Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/116xxx/CVE-2026-116329.json b/data/2026/116xxx/CVE-2026-116329.json index 798846f887..d292fbaf98 100644 --- a/data/2026/116xxx/CVE-2026-116329.json +++ b/data/2026/116xxx/CVE-2026-116329.json @@ -8,7 +8,7 @@ "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T03:52:44.054Z", "datePublished": "2026-11-12T14:15:16.818Z", - "dateUpdated": "2026-11-12T14:15:16.818Z" + "dateUpdated": "2026-11-13T20:24:00.000Z" }, "containers": { "cna": { @@ -82,6 +82,40 @@ "value": "The PostgreSQL project thanks Mehmet D. INCE for reporting this problem." } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:23:47.889772Z", + "id": "CVE-2026-116329", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:24:00.000Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/116xxx/CVE-2026-116330.json b/data/2026/116xxx/CVE-2026-116330.json index e20ad153fe..4e4327667d 100644 --- a/data/2026/116xxx/CVE-2026-116330.json +++ b/data/2026/116xxx/CVE-2026-116330.json @@ -8,7 +8,7 @@ "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T03:52:44.054Z", "datePublished": "2026-11-12T14:15:17.385Z", - "dateUpdated": "2026-11-12T14:15:17.385Z" + "dateUpdated": "2026-11-13T20:22:53.399Z" }, "containers": { "cna": { @@ -112,6 +112,40 @@ "value": "The PostgreSQL project thanks Pavel Kopylov for reporting this problem." } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:22:37.964637Z", + "id": "CVE-2026-116330", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:22:53.399Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/116xxx/CVE-2026-116411.json b/data/2026/116xxx/CVE-2026-116411.json index f74a9aad78..79157d2074 100644 --- a/data/2026/116xxx/CVE-2026-116411.json +++ b/data/2026/116xxx/CVE-2026-116411.json @@ -8,7 +8,7 @@ "assignerShortName": "dell", "dateReserved": "2026-10-26T10:04:27.242Z", "datePublished": "2026-11-13T14:03:41.940Z", - "dateUpdated": "2026-11-13T14:03:41.940Z" + "dateUpdated": "2026-11-13T21:03:42.346Z" }, "containers": { "cna": { @@ -279,6 +279,40 @@ "x_generator": { "engine": "Vulnogram 1.0.5" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:03:33.585939Z", + "id": "CVE-2026-116411", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:03:42.346Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120804.json b/data/2026/120xxx/CVE-2026-120804.json index 8573d96f4b..e09f1a314d 100644 --- a/data/2026/120xxx/CVE-2026-120804.json +++ b/data/2026/120xxx/CVE-2026-120804.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:13.381Z", "datePublished": "2026-11-10T20:03:44.297Z", - "dateUpdated": "2026-11-10T20:03:44.297Z" + "dateUpdated": "2026-11-13T21:04:52.733Z" }, "containers": { "cna": { @@ -145,6 +145,40 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:00:04.358841Z", + "id": "CVE-2026-120804", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:04:52.733Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120806.json b/data/2026/120xxx/CVE-2026-120806.json index 530ca04bfb..4f80bbe41c 100644 --- a/data/2026/120xxx/CVE-2026-120806.json +++ b/data/2026/120xxx/CVE-2026-120806.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:16.355Z", "datePublished": "2026-11-10T20:05:18.025Z", - "dateUpdated": "2026-11-10T20:05:18.025Z" + "dateUpdated": "2026-11-13T20:59:24.084Z" }, "containers": { "cna": { @@ -145,6 +145,40 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:59:13.971288Z", + "id": "CVE-2026-120806", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:59:24.084Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120807.json b/data/2026/120xxx/CVE-2026-120807.json index 1ac53b2002..185bda409e 100644 --- a/data/2026/120xxx/CVE-2026-120807.json +++ b/data/2026/120xxx/CVE-2026-120807.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:17.417Z", "datePublished": "2026-11-10T20:06:29.243Z", - "dateUpdated": "2026-11-10T20:06:29.243Z" + "dateUpdated": "2026-11-13T20:58:27.123Z" }, "containers": { "cna": { @@ -145,6 +145,48 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://jira.mongodb.org/browse/SERVER-130169", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:58:20.653578Z", + "id": "CVE-2026-120807", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:58:27.123Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120814.json b/data/2026/120xxx/CVE-2026-120814.json index 41bf1b0c8e..bac51811de 100644 --- a/data/2026/120xxx/CVE-2026-120814.json +++ b/data/2026/120xxx/CVE-2026-120814.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:26.669Z", "datePublished": "2026-11-10T20:12:13.822Z", - "dateUpdated": "2026-11-10T20:12:13.822Z" + "dateUpdated": "2026-11-13T20:15:47.198Z" }, "containers": { "cna": { @@ -139,6 +139,40 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:15:34.501270Z", + "id": "CVE-2026-120814", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:15:47.198Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120815.json b/data/2026/120xxx/CVE-2026-120815.json index 4ada555c48..de7c634a88 100644 --- a/data/2026/120xxx/CVE-2026-120815.json +++ b/data/2026/120xxx/CVE-2026-120815.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:28.946Z", "datePublished": "2026-11-10T20:13:00.772Z", - "dateUpdated": "2026-11-10T20:13:00.772Z" + "dateUpdated": "2026-11-13T20:27:53.960Z" }, "containers": { "cna": { @@ -145,6 +145,48 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://jira.mongodb.org/browse/SERVER-134872", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:27:49.289198Z", + "id": "CVE-2026-120815", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:27:53.960Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120819.json b/data/2026/120xxx/CVE-2026-120819.json index 4dc84abf2d..d22e6c2fac 100644 --- a/data/2026/120xxx/CVE-2026-120819.json +++ b/data/2026/120xxx/CVE-2026-120819.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:36.448Z", "datePublished": "2026-11-10T20:24:31.890Z", - "dateUpdated": "2026-11-10T20:24:31.890Z" + "dateUpdated": "2026-11-13T20:36:13.204Z" }, "containers": { "cna": { @@ -127,6 +127,40 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:36:03.651730Z", + "id": "CVE-2026-120819", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:36:13.204Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120823.json b/data/2026/120xxx/CVE-2026-120823.json index e6d192d972..a223d7042f 100644 --- a/data/2026/120xxx/CVE-2026-120823.json +++ b/data/2026/120xxx/CVE-2026-120823.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:41.853Z", "datePublished": "2026-11-10T20:19:49.394Z", - "dateUpdated": "2026-11-10T20:19:49.394Z" + "dateUpdated": "2026-11-13T20:35:00.695Z" }, "containers": { "cna": { @@ -127,6 +127,40 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:34:51.506760Z", + "id": "CVE-2026-120823", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:35:00.695Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120825.json b/data/2026/120xxx/CVE-2026-120825.json index fd44fa64b0..6cabcfee61 100644 --- a/data/2026/120xxx/CVE-2026-120825.json +++ b/data/2026/120xxx/CVE-2026-120825.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:46.452Z", "datePublished": "2026-11-10T20:21:20.207Z", - "dateUpdated": "2026-11-10T20:21:20.207Z" + "dateUpdated": "2026-11-13T20:32:39.390Z" }, "containers": { "cna": { @@ -130,6 +130,48 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://jira.mongodb.org/browse/SERVER-136876", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:32:30.370273Z", + "id": "CVE-2026-120825", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:32:39.390Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120826.json b/data/2026/120xxx/CVE-2026-120826.json index bd7b5ff31e..76ca91122f 100644 --- a/data/2026/120xxx/CVE-2026-120826.json +++ b/data/2026/120xxx/CVE-2026-120826.json @@ -8,7 +8,7 @@ "assignerShortName": "mongodb", "dateReserved": "2026-11-02T22:54:48.740Z", "datePublished": "2026-11-10T20:22:04.078Z", - "dateUpdated": "2026-11-10T20:22:04.078Z" + "dateUpdated": "2026-11-13T20:33:49.621Z" }, "containers": { "cna": { @@ -127,6 +127,40 @@ "x_generator": { "engine": "cve_record_builder.py" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:33:39.830014Z", + "id": "CVE-2026-120826", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:33:49.621Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123039.json b/data/2026/123xxx/CVE-2026-123039.json index 80c0b37a4c..3eefda5bb1 100644 --- a/data/2026/123xxx/CVE-2026-123039.json +++ b/data/2026/123xxx/CVE-2026-123039.json @@ -8,7 +8,7 @@ "assignerShortName": "checkpoint", "dateReserved": "2026-11-05T07:30:18.138Z", "datePublished": "2026-11-12T14:02:13.665Z", - "dateUpdated": "2026-11-13T19:25:14.608Z" + "dateUpdated": "2026-11-13T20:58:23.802Z" }, "containers": { "cna": { @@ -146,6 +146,15 @@ "timestamp": "2026-11-13T19:16:35.345993Z" } } + }, + { + "other": { + "type": "kev", + "content": { + "dateAdded": "2026-11-13", + "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123039" + } + } } ], "references": [ @@ -160,8 +169,15 @@ "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", - "dateUpdated": "2026-11-13T19:25:14.608Z" - } + "dateUpdated": "2026-11-13T20:58:23.802Z" + }, + "timeline": [ + { + "time": "2026-11-13T00:00:00.000Z", + "lang": "en", + "value": "CVE-2026-123039 added to CISA KEV" + } + ] } ] } diff --git a/data/2026/123xxx/CVE-2026-123710.json b/data/2026/123xxx/CVE-2026-123710.json index 7b5dd9a0a5..7b735a3d16 100644 --- a/data/2026/123xxx/CVE-2026-123710.json +++ b/data/2026/123xxx/CVE-2026-123710.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-11-06T10:23:55.509Z", "datePublished": "2026-11-11T15:02:31.341Z", - "dateUpdated": "2026-11-13T14:18:08.901Z" + "dateUpdated": "2026-11-13T20:50:57.503Z" }, "containers": { "cna": { @@ -249,6 +249,16 @@ "cpe:/a:redhat:quay:3.9::el8" ] }, + { + "vendor": "Red Hat", + "product": "mirror registry for Red Hat OpenShift 2", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "openshift/mirror-registry-rhel8", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:mirror_registry:2" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Quay 5", @@ -385,7 +395,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-13T00:21:58.960Z" + "dateUpdated": "2026-11-13T20:50:57.503Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/124xxx/CVE-2026-124016.json b/data/2026/124xxx/CVE-2026-124016.json index 4368485adb..eb2ee8321f 100644 --- a/data/2026/124xxx/CVE-2026-124016.json +++ b/data/2026/124xxx/CVE-2026-124016.json @@ -8,14 +8,14 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T18:38:38.544Z", "datePublished": "2026-11-10T19:22:30.485Z", - "dateUpdated": "2026-11-10T21:03:45.609Z" + "dateUpdated": "2026-11-13T20:29:09.130Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", - "dateUpdated": "2026-11-10T19:22:30.485Z" + "dateUpdated": "2026-11-13T20:29:09.130Z" }, "title": "postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine", "descriptions": [ @@ -144,6 +144,11 @@ "lang": "en", "value": "Arjun Jain", "type": "finder" + }, + { + "lang": "en", + "value": "Mohd Absar Ansari", + "type": "finder" } ], "x_generator": { diff --git a/data/2026/124xxx/CVE-2026-124412.json b/data/2026/124xxx/CVE-2026-124412.json index cba582d190..b8f5ccc05f 100644 --- a/data/2026/124xxx/CVE-2026-124412.json +++ b/data/2026/124xxx/CVE-2026-124412.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-08T00:26:41.330Z", "datePublished": "2026-11-13T14:40:28.529Z", - "dateUpdated": "2026-11-13T14:41:28.379Z" + "dateUpdated": "2026-11-13T21:04:23.442Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:04:14.336478Z", + "id": "CVE-2026-124412", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:04:23.442Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125440.json b/data/2026/125xxx/CVE-2026-125440.json index a6e6a3c54c..db611afacf 100644 --- a/data/2026/125xxx/CVE-2026-125440.json +++ b/data/2026/125xxx/CVE-2026-125440.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T00:26:46.521Z", "datePublished": "2026-11-13T14:41:09.092Z", - "dateUpdated": "2026-11-13T14:41:17.329Z" + "dateUpdated": "2026-11-13T21:04:45.839Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:04:35.072473Z", + "id": "CVE-2026-125440", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:04:45.839Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125801.json b/data/2026/125xxx/CVE-2026-125801.json index 3de14d0994..3484d1d825 100644 --- a/data/2026/125xxx/CVE-2026-125801.json +++ b/data/2026/125xxx/CVE-2026-125801.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:37:30.986Z", "datePublished": "2026-11-13T13:05:08.445Z", - "dateUpdated": "2026-11-13T13:05:33.407Z" + "dateUpdated": "2026-11-13T21:02:48.967Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:02:41.045962Z", + "id": "CVE-2026-125801", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:02:48.967Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125814.json b/data/2026/125xxx/CVE-2026-125814.json index c46a079b4c..f763b9c657 100644 --- a/data/2026/125xxx/CVE-2026-125814.json +++ b/data/2026/125xxx/CVE-2026-125814.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:37:30.988Z", "datePublished": "2026-11-13T12:58:27.612Z", - "dateUpdated": "2026-11-13T14:30:05.493Z" + "dateUpdated": "2026-11-13T21:02:29.695Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:02:18.925992Z", + "id": "CVE-2026-125814", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:02:29.695Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125821.json b/data/2026/125xxx/CVE-2026-125821.json index 0215f95d7d..b24493d95c 100644 --- a/data/2026/125xxx/CVE-2026-125821.json +++ b/data/2026/125xxx/CVE-2026-125821.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:37:30.990Z", "datePublished": "2026-11-13T14:40:09.916Z", - "dateUpdated": "2026-11-13T14:41:13.773Z" + "dateUpdated": "2026-11-13T21:04:00.786Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:03:52.838671Z", + "id": "CVE-2026-125821", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:04:00.786Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126267.json b/data/2026/126xxx/CVE-2026-126267.json index 8746c89332..da3b1e6aee 100644 --- a/data/2026/126xxx/CVE-2026-126267.json +++ b/data/2026/126xxx/CVE-2026-126267.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:13:22.557Z", "datePublished": "2026-11-13T09:36:49.116Z", - "dateUpdated": "2026-11-13T09:36:49.116Z" + "dateUpdated": "2026-11-13T20:37:33.797Z" }, "containers": { "cna": { @@ -140,6 +140,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:37:25.162643Z", + "id": "CVE-2026-126267", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:37:33.797Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126271.json b/data/2026/126xxx/CVE-2026-126271.json index a90c784757..19165de377 100644 --- a/data/2026/126xxx/CVE-2026-126271.json +++ b/data/2026/126xxx/CVE-2026-126271.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:13:22.557Z", "datePublished": "2026-11-13T09:36:46.548Z", - "dateUpdated": "2026-11-13T09:36:46.548Z" + "dateUpdated": "2026-11-13T20:38:19.263Z" }, "containers": { "cna": { @@ -132,6 +132,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:38:08.438317Z", + "id": "CVE-2026-126271", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:38:19.263Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126275.json b/data/2026/126xxx/CVE-2026-126275.json index 824cc4f79a..8a7f7cf7be 100644 --- a/data/2026/126xxx/CVE-2026-126275.json +++ b/data/2026/126xxx/CVE-2026-126275.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:14:15.972Z", "datePublished": "2026-11-13T09:36:43.720Z", - "dateUpdated": "2026-11-13T09:36:43.720Z" + "dateUpdated": "2026-11-13T20:38:58.822Z" }, "containers": { "cna": { @@ -144,6 +144,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:38:47.604597Z", + "id": "CVE-2026-126275", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:38:58.822Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126279.json b/data/2026/126xxx/CVE-2026-126279.json index 8ce6ecd98e..33357cfc5b 100644 --- a/data/2026/126xxx/CVE-2026-126279.json +++ b/data/2026/126xxx/CVE-2026-126279.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:14:15.972Z", "datePublished": "2026-11-13T09:36:40.988Z", - "dateUpdated": "2026-11-13T09:36:40.988Z" + "dateUpdated": "2026-11-13T20:39:25.596Z" }, "containers": { "cna": { @@ -139,6 +139,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:39:15.720615Z", + "id": "CVE-2026-126279", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:39:25.596Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126283.json b/data/2026/126xxx/CVE-2026-126283.json index aa28098b10..d8a4222d30 100644 --- a/data/2026/126xxx/CVE-2026-126283.json +++ b/data/2026/126xxx/CVE-2026-126283.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:14:15.972Z", "datePublished": "2026-11-13T09:36:37.190Z", - "dateUpdated": "2026-11-13T09:36:37.190Z" + "dateUpdated": "2026-11-13T20:40:00.858Z" }, "containers": { "cna": { @@ -139,6 +139,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:39:47.530554Z", + "id": "CVE-2026-126283", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:40:00.858Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126287.json b/data/2026/126xxx/CVE-2026-126287.json index 1069e887eb..2075ec20a5 100644 --- a/data/2026/126xxx/CVE-2026-126287.json +++ b/data/2026/126xxx/CVE-2026-126287.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:15:03.178Z", "datePublished": "2026-11-13T09:36:34.544Z", - "dateUpdated": "2026-11-13T09:36:34.544Z" + "dateUpdated": "2026-11-13T21:01:35.614Z" }, "containers": { "cna": { @@ -139,6 +139,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:01:24.325002Z", + "id": "CVE-2026-126287", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:01:35.614Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126291.json b/data/2026/126xxx/CVE-2026-126291.json index 59a95b265c..0ddb9686f3 100644 --- a/data/2026/126xxx/CVE-2026-126291.json +++ b/data/2026/126xxx/CVE-2026-126291.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:15:03.179Z", "datePublished": "2026-11-13T09:36:31.871Z", - "dateUpdated": "2026-11-13T09:36:31.871Z" + "dateUpdated": "2026-11-13T20:40:37.581Z" }, "containers": { "cna": { @@ -139,6 +139,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:40:22.240291Z", + "id": "CVE-2026-126291", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:40:37.581Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126295.json b/data/2026/126xxx/CVE-2026-126295.json index 048008ce12..fbeea9d46d 100644 --- a/data/2026/126xxx/CVE-2026-126295.json +++ b/data/2026/126xxx/CVE-2026-126295.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:15:54.612Z", "datePublished": "2026-11-13T09:36:29.196Z", - "dateUpdated": "2026-11-13T09:36:29.196Z" + "dateUpdated": "2026-11-13T20:41:23.672Z" }, "containers": { "cna": { @@ -146,6 +146,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:41:03.126005Z", + "id": "CVE-2026-126295", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:41:23.672Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126299.json b/data/2026/126xxx/CVE-2026-126299.json index c90bec52d8..57299491b4 100644 --- a/data/2026/126xxx/CVE-2026-126299.json +++ b/data/2026/126xxx/CVE-2026-126299.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:15:54.612Z", "datePublished": "2026-11-13T09:36:26.544Z", - "dateUpdated": "2026-11-13T09:36:26.544Z" + "dateUpdated": "2026-11-13T20:41:58.817Z" }, "containers": { "cna": { @@ -140,6 +140,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:41:49.316593Z", + "id": "CVE-2026-126299", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:41:58.817Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126303.json b/data/2026/126xxx/CVE-2026-126303.json index 28489801a3..01467c1cfa 100644 --- a/data/2026/126xxx/CVE-2026-126303.json +++ b/data/2026/126xxx/CVE-2026-126303.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:15:54.613Z", "datePublished": "2026-11-13T09:36:23.874Z", - "dateUpdated": "2026-11-13T09:36:23.874Z" + "dateUpdated": "2026-11-13T21:01:08.245Z" }, "containers": { "cna": { @@ -145,6 +145,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/nltk/nltk/security/advisories/GHSA-8fx7-8jr8-84rv", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:00:44.295232Z", + "id": "CVE-2026-126303", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:01:08.245Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126307.json b/data/2026/126xxx/CVE-2026-126307.json index 9742eb72b1..f6558b96c5 100644 --- a/data/2026/126xxx/CVE-2026-126307.json +++ b/data/2026/126xxx/CVE-2026-126307.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:16:44.443Z", "datePublished": "2026-11-13T09:36:21.073Z", - "dateUpdated": "2026-11-13T09:36:21.073Z" + "dateUpdated": "2026-11-13T20:49:25.399Z" }, "containers": { "cna": { @@ -144,6 +144,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:44:42.476633Z", + "id": "CVE-2026-126307", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:49:25.399Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126311.json b/data/2026/126xxx/CVE-2026-126311.json index 822829e889..0cc29307ba 100644 --- a/data/2026/126xxx/CVE-2026-126311.json +++ b/data/2026/126xxx/CVE-2026-126311.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:16:44.443Z", "datePublished": "2026-11-13T09:36:18.274Z", - "dateUpdated": "2026-11-13T09:36:18.274Z" + "dateUpdated": "2026-11-13T20:44:08.862Z" }, "containers": { "cna": { @@ -167,6 +167,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:43:46.448404Z", + "id": "CVE-2026-126311", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:44:08.862Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126315.json b/data/2026/126xxx/CVE-2026-126315.json index c288e90f0c..370c43a1c6 100644 --- a/data/2026/126xxx/CVE-2026-126315.json +++ b/data/2026/126xxx/CVE-2026-126315.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:18:40.992Z", "datePublished": "2026-11-13T09:36:15.474Z", - "dateUpdated": "2026-11-13T09:36:15.474Z" + "dateUpdated": "2026-11-13T20:43:15.149Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:42:57.515075Z", + "id": "CVE-2026-126315", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:43:15.149Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126319.json b/data/2026/126xxx/CVE-2026-126319.json index 00e1faebfd..8211b05413 100644 --- a/data/2026/126xxx/CVE-2026-126319.json +++ b/data/2026/126xxx/CVE-2026-126319.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:18:40.992Z", "datePublished": "2026-11-13T09:36:12.691Z", - "dateUpdated": "2026-11-13T09:36:12.691Z" + "dateUpdated": "2026-11-13T20:42:34.401Z" }, "containers": { "cna": { @@ -122,6 +122,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:42:24.862755Z", + "id": "CVE-2026-126319", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:42:34.401Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126323.json b/data/2026/126xxx/CVE-2026-126323.json index a1f348341a..617f29d5ce 100644 --- a/data/2026/126xxx/CVE-2026-126323.json +++ b/data/2026/126xxx/CVE-2026-126323.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T20:18:40.992Z", "datePublished": "2026-11-13T09:36:09.910Z", - "dateUpdated": "2026-11-13T09:36:09.910Z" + "dateUpdated": "2026-11-13T20:28:16.894Z" }, "containers": { "cna": { @@ -146,6 +146,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-grxp-rj92-j8xr", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:27:47.750229Z", + "id": "CVE-2026-126323", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:28:16.894Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126372.json b/data/2026/126xxx/CVE-2026-126372.json index 9b4943197c..0db7c1f8ad 100644 --- a/data/2026/126xxx/CVE-2026-126372.json +++ b/data/2026/126xxx/CVE-2026-126372.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:25:31.549Z", "datePublished": "2026-11-13T09:36:07.223Z", - "dateUpdated": "2026-11-13T09:36:07.223Z" + "dateUpdated": "2026-11-13T20:32:40.888Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:32:12.019157Z", + "id": "CVE-2026-126372", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:32:40.888Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126376.json b/data/2026/126xxx/CVE-2026-126376.json index 97614bd47a..25332d3fc5 100644 --- a/data/2026/126xxx/CVE-2026-126376.json +++ b/data/2026/126xxx/CVE-2026-126376.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:25:31.550Z", "datePublished": "2026-11-13T09:36:04.558Z", - "dateUpdated": "2026-11-13T09:36:04.558Z" + "dateUpdated": "2026-11-13T20:31:39.971Z" }, "containers": { "cna": { @@ -128,6 +128,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-g7j8-g4xq-f232", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:31:15.869440Z", + "id": "CVE-2026-126376", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:31:39.971Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126380.json b/data/2026/126xxx/CVE-2026-126380.json index f2c50d0f90..98549c4013 100644 --- a/data/2026/126xxx/CVE-2026-126380.json +++ b/data/2026/126xxx/CVE-2026-126380.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:26:25.841Z", "datePublished": "2026-11-13T09:36:01.857Z", - "dateUpdated": "2026-11-13T09:36:01.857Z" + "dateUpdated": "2026-11-13T20:30:48.952Z" }, "containers": { "cna": { @@ -147,6 +147,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-hcpj-pcpx-2744", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:30:22.567467Z", + "id": "CVE-2026-126380", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:30:48.952Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126384.json b/data/2026/126xxx/CVE-2026-126384.json index af02d0b272..e146ebd07d 100644 --- a/data/2026/126xxx/CVE-2026-126384.json +++ b/data/2026/126xxx/CVE-2026-126384.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:26:25.841Z", "datePublished": "2026-11-13T09:35:59.112Z", - "dateUpdated": "2026-11-13T09:35:59.112Z" + "dateUpdated": "2026-11-13T20:29:55.203Z" }, "containers": { "cna": { @@ -250,6 +250,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:29:42.541878Z", + "id": "CVE-2026-126384", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:29:55.203Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126388.json b/data/2026/126xxx/CVE-2026-126388.json index d625e6408d..bf605468d6 100644 --- a/data/2026/126xxx/CVE-2026-126388.json +++ b/data/2026/126xxx/CVE-2026-126388.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:26:25.842Z", "datePublished": "2026-11-13T09:35:56.306Z", - "dateUpdated": "2026-11-13T09:35:56.306Z" + "dateUpdated": "2026-11-13T20:29:15.655Z" }, "containers": { "cna": { @@ -210,6 +210,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:29:03.430158Z", + "id": "CVE-2026-126388", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:29:15.655Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126392.json b/data/2026/126xxx/CVE-2026-126392.json index 1453fd7f01..c9584ececc 100644 --- a/data/2026/126xxx/CVE-2026-126392.json +++ b/data/2026/126xxx/CVE-2026-126392.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:30:16.910Z", "datePublished": "2026-11-13T09:35:53.670Z", - "dateUpdated": "2026-11-13T09:35:53.670Z" + "dateUpdated": "2026-11-13T20:23:17.302Z" }, "containers": { "cna": { @@ -166,6 +166,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:23:03.905458Z", + "id": "CVE-2026-126392", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:23:17.302Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126396.json b/data/2026/126xxx/CVE-2026-126396.json index 7f8afd296d..aeec5fc7eb 100644 --- a/data/2026/126xxx/CVE-2026-126396.json +++ b/data/2026/126xxx/CVE-2026-126396.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:30:16.910Z", "datePublished": "2026-11-13T09:35:50.950Z", - "dateUpdated": "2026-11-13T11:44:37.122Z" + "dateUpdated": "2026-11-13T20:27:21.640Z" }, "containers": { "cna": { @@ -164,6 +164,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:27:09.832988Z", + "id": "CVE-2026-126396", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:27:21.640Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126400.json b/data/2026/126xxx/CVE-2026-126400.json index e68c6ef553..3ce20e4f2c 100644 --- a/data/2026/126xxx/CVE-2026-126400.json +++ b/data/2026/126xxx/CVE-2026-126400.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:32:21.764Z", "datePublished": "2026-11-13T09:35:48.368Z", - "dateUpdated": "2026-11-13T09:35:48.368Z" + "dateUpdated": "2026-11-13T20:26:37.816Z" }, "containers": { "cna": { @@ -122,6 +122,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:26:24.328891Z", + "id": "CVE-2026-126400", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:26:37.816Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126404.json b/data/2026/126xxx/CVE-2026-126404.json index 2da22d6038..0d42842a28 100644 --- a/data/2026/126xxx/CVE-2026-126404.json +++ b/data/2026/126xxx/CVE-2026-126404.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:32:21.765Z", "datePublished": "2026-11-13T09:35:45.631Z", - "dateUpdated": "2026-11-13T09:35:45.631Z" + "dateUpdated": "2026-11-13T20:26:01.693Z" }, "containers": { "cna": { @@ -321,6 +321,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:25:47.107888Z", + "id": "CVE-2026-126404", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:26:01.693Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126408.json b/data/2026/126xxx/CVE-2026-126408.json index 36430adb0a..8c58ca5982 100644 --- a/data/2026/126xxx/CVE-2026-126408.json +++ b/data/2026/126xxx/CVE-2026-126408.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:32:21.765Z", "datePublished": "2026-11-13T09:35:42.943Z", - "dateUpdated": "2026-11-13T09:35:42.943Z" + "dateUpdated": "2026-11-13T20:25:12.084Z" }, "containers": { "cna": { @@ -204,6 +204,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:24:29.977618Z", + "id": "CVE-2026-126408", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:25:12.084Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126412.json b/data/2026/126xxx/CVE-2026-126412.json index 8b56e485a3..21446decb8 100644 --- a/data/2026/126xxx/CVE-2026-126412.json +++ b/data/2026/126xxx/CVE-2026-126412.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:34:05.396Z", "datePublished": "2026-11-13T09:35:39.219Z", - "dateUpdated": "2026-11-13T09:35:39.219Z" + "dateUpdated": "2026-11-13T20:23:56.740Z" }, "containers": { "cna": { @@ -152,6 +152,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:23:39.799081Z", + "id": "CVE-2026-126412", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:23:56.740Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126424.json b/data/2026/126xxx/CVE-2026-126424.json index a7d8c226d4..07c6e9211d 100644 --- a/data/2026/126xxx/CVE-2026-126424.json +++ b/data/2026/126xxx/CVE-2026-126424.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-10T21:36:07.090Z", "datePublished": "2026-11-13T09:35:31.004Z", - "dateUpdated": "2026-11-13T09:35:31.004Z" + "dateUpdated": "2026-11-13T20:13:57.502Z" }, "containers": { "cna": { @@ -139,6 +139,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/openemr/openemr/security/advisories/GHSA-qv97-cvw6-8j53", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:13:15.416511Z", + "id": "CVE-2026-126424", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:13:57.502Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/127xxx/CVE-2026-127216.json b/data/2026/127xxx/CVE-2026-127216.json new file mode 100644 index 0000000000..f991a8498c --- /dev/null +++ b/data/2026/127xxx/CVE-2026-127216.json @@ -0,0 +1,145 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-127216", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-12T16:30:10.904Z", + "datePublished": "2026-11-13T20:41:10.804Z", + "dateUpdated": "2026-11-13T20:41:10.804Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-13T20:41:10.804Z" + }, + "title": "Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure", + "descriptions": [ + { + "lang": "en", + "value": "Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_settings admin page in templates/dashboard.php processes GET parameters without nonce verification. Attackers can exploit this to cause the plugin to write WooCommerce customer email hashes and password hashes to an unprotected file at wp-content/plugins/injection-guard/ab-hash.dat, which can then be downloaded without authentication to obtain customer password hashes for offline cracking." + } + ], + "tags": [ + "x_open-source" + ], + "datePublic": "2026-11-13T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Cross-Site Request Forgery (CSRF)", + "cweId": "CWE-352", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "defaultStatus": "unaffected", + "vendor": "Fahad Mahmood", + "product": "Injection Guard", + "versions": [ + { + "status": "affected", + "version": "0", + "versionType": "semver", + "lessThan": "1.4.0" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 7.1, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "version": "3.1", + "baseSeverity": "MEDIUM", + "baseScore": 6.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + } + } + ], + "references": [ + { + "url": "https://wordpress.org/plugins/injection-guard/#developers", + "name": "WordPress Changelog", + "tags": [ + "release-notes", + "patch" + ] + }, + { + "url": "https://www.vulncheck.com/advisories/injection-guard-wordpress-plugin-csrf-password-hash-disclosure", + "name": "VulnCheck Advisory: Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure", + "tags": [ + "third-party-advisory" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "buiih", + "type": "reporter" + } + ], + "x_generator": { + "engine": "vulncheck" + } + } + } +} \ No newline at end of file diff --git a/data/2026/127xxx/CVE-2026-127217.json b/data/2026/127xxx/CVE-2026-127217.json new file mode 100644 index 0000000000..0669c41cad --- /dev/null +++ b/data/2026/127xxx/CVE-2026-127217.json @@ -0,0 +1,145 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-127217", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-12T16:30:10.904Z", + "datePublished": "2026-11-13T21:03:19.812Z", + "dateUpdated": "2026-11-13T21:03:19.812Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-13T21:03:19.812Z" + }, + "title": "Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route", + "descriptions": [ + { + "lang": "en", + "value": "Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server." + } + ], + "tags": [ + "x_open-source" + ], + "datePublic": "2026-11-12T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Server-Side Request Forgery (SSRF)", + "cweId": "CWE-918", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "defaultStatus": "unaffected", + "vendor": "Koen Reus", + "product": "Post to Google My Business (Google Business Profile)", + "versions": [ + { + "status": "affected", + "version": "0", + "versionType": "semver", + "lessThan": "3.5.7" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "subConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "subIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "MEDIUM", + "baseScore": 5.3, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "version": "3.1", + "baseSeverity": "MEDIUM", + "baseScore": 6.4, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + } + ], + "references": [ + { + "url": "https://wordpress.org/plugins/post-to-google-my-business/#developers", + "name": "WordPress Changelog", + "tags": [ + "release-notes", + "patch" + ] + }, + { + "url": "https://www.vulncheck.com/advisories/post-to-google-my-business-wordpress-plugin-ssrf-via-preview-rest-route", + "name": "VulnCheck Advisory: Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route", + "tags": [ + "third-party-advisory" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "buiih", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128070.json b/data/2026/128xxx/CVE-2026-128070.json index 5444d24c73..ab95e54ca0 100644 --- a/data/2026/128xxx/CVE-2026-128070.json +++ b/data/2026/128xxx/CVE-2026-128070.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-11-12T21:24:51.129Z", "datePublished": "2026-11-13T17:20:27.855Z", - "dateUpdated": "2026-11-13T17:20:27.855Z" + "dateUpdated": "2026-11-13T21:09:22.550Z" }, "containers": { "cna": { @@ -103,6 +103,40 @@ "advisory": "GHSA-mjrq-cffv-q4qc", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:09:14.953060Z", + "id": "CVE-2026-128070", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:09:22.550Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128075.json b/data/2026/128xxx/CVE-2026-128075.json index b2a54752ed..ac929d7d68 100644 --- a/data/2026/128xxx/CVE-2026-128075.json +++ b/data/2026/128xxx/CVE-2026-128075.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-11-12T21:24:51.130Z", "datePublished": "2026-11-13T17:36:17.283Z", - "dateUpdated": "2026-11-13T17:36:17.283Z" + "dateUpdated": "2026-11-13T21:16:08.311Z" }, "containers": { "cna": { @@ -93,6 +93,40 @@ "advisory": "GHSA-96x6-fvhx-49hg", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:15:59.126778Z", + "id": "CVE-2026-128075", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:16:08.311Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128082.json b/data/2026/128xxx/CVE-2026-128082.json index 43c5b5b511..bfd33798df 100644 --- a/data/2026/128xxx/CVE-2026-128082.json +++ b/data/2026/128xxx/CVE-2026-128082.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-11-12T21:24:51.130Z", "datePublished": "2026-11-13T18:37:30.465Z", - "dateUpdated": "2026-11-13T18:37:30.465Z" + "dateUpdated": "2026-11-13T21:17:15.616Z" }, "containers": { "cna": { @@ -111,6 +111,48 @@ "advisory": "GHSA-6vhm-j9h7-f9gh", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-6vhm-j9h7-f9gh", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:16:56.451187Z", + "id": "CVE-2026-128082", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:17:15.616Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128087.json b/data/2026/128xxx/CVE-2026-128087.json index 4e703f22d1..1fcc4a7da6 100644 --- a/data/2026/128xxx/CVE-2026-128087.json +++ b/data/2026/128xxx/CVE-2026-128087.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-11-12T21:24:51.131Z", "datePublished": "2026-11-13T19:03:26.702Z", - "dateUpdated": "2026-11-13T19:03:26.702Z" + "dateUpdated": "2026-11-13T21:15:30.367Z" }, "containers": { "cna": { @@ -110,6 +110,48 @@ "advisory": "GHSA-9264-jvgf-6w2f", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9264-jvgf-6w2f", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:15:11.345733Z", + "id": "CVE-2026-128087", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:15:30.367Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128100.json b/data/2026/128xxx/CVE-2026-128100.json index daa12c5c3d..4313efb9ab 100644 --- a/data/2026/128xxx/CVE-2026-128100.json +++ b/data/2026/128xxx/CVE-2026-128100.json @@ -8,7 +8,7 @@ "assignerShortName": "HashiCorp", "dateReserved": "2026-11-12T22:16:53.115Z", "datePublished": "2026-11-13T20:10:09.065Z", - "dateUpdated": "2026-11-13T20:10:09.065Z" + "dateUpdated": "2026-11-13T21:10:55.961Z" }, "containers": { "cna": { @@ -152,6 +152,40 @@ "discovery": "EXTERNAL" }, "title": "Vault vulnerable to ACL deny bypass via case-variant auth method user and group names" - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:10:47.532219Z", + "id": "CVE-2026-128100", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:10:55.961Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128124.json b/data/2026/128xxx/CVE-2026-128124.json new file mode 100644 index 0000000000..eb45443366 --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128124.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128124", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.031Z", + "datePublished": "2026-11-13T20:22:36.733Z", + "dateUpdated": "2026-11-13T20:22:36.733Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: Event loop stall in add_domain() wildcard matching", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-1333", + "lang": "en", + "description": "CWE-1333: Inefficient Regular Expression Complexity", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jm3w-gw2p-xjfj", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jm3w-gw2p-xjfj" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13943", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13943" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13945", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13945" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/766b882820da0651c84090e366a3b024b4a263c9", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/766b882820da0651c84090e366a3b024b4a263c9" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:22:36.733Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain() converts every asterisk wildcard in a domain mask into a greedy regular-expression fragment, so a mask containing two or more wildcards can take polynomial time to reject a long Host header that does not match. A remote attacker can repeatedly send such headers to a server configured with a multi-wildcard domain mask and stall the event loop. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-jm3w-gw2p-xjfj", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128125.json b/data/2026/128xxx/CVE-2026-128125.json new file mode 100644 index 0000000000..dfe6286838 --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128125.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128125", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.032Z", + "datePublished": "2026-11-13T20:25:56.650Z", + "dateUpdated": "2026-11-13T20:25:56.650Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: Unbounded cookie storage in client CookieJar", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-1325", + "lang": "en", + "description": "CWE-1325: Improperly Controlled Sequential Memory Allocation", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13930", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13930" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13942", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13942" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:25:56.650Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-5pv8-vvhc-h7jv", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128126.json b/data/2026/128xxx/CVE-2026-128126.json new file mode 100644 index 0000000000..1ef874ef66 --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128126.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128126", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.032Z", + "datePublished": "2026-11-13T20:27:57.071Z", + "dateUpdated": "2026-11-13T20:27:57.071Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: Too many URL-encoded form fields block the event loop", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-407", + "lang": "en", + "description": "CWE-407: Inefficient Algorithmic Complexity", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xgw8-8ccx-rmqh", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xgw8-8ccx-rmqh" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13738", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13738" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13741", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13741" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/8b0100572936df28977b9de8a6cc7e464c0b521e", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/8b0100572936df28977b9de8a6cc7e464c0b521e" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:27:57.071Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post() does not limit the number of fields in a URL-encoded form body, and inserting many repeated keys into MultiDict takes quadratic time on the event loop. A remote attacker can send a form POST within client_max_size to a handler that calls Request.post() and block the event loop. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-xgw8-8ccx-rmqh", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128127.json b/data/2026/128xxx/CVE-2026-128127.json new file mode 100644 index 0000000000..dff3c572e1 --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128127.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128127", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.032Z", + "datePublished": "2026-11-13T20:30:19.198Z", + "dateUpdated": "2026-11-13T20:30:19.198Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: Base64 multipart parts bypass client_max_size", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-400", + "lang": "en", + "description": "CWE-400: Uncontrolled Resource Consumption", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-24c4-3p7v-29cm", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-24c4-3p7v-29cm" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13509", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13509" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13513", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13513" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/2d9c5c1062eff0034fb3ab120897a6c1b3ff7041", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/2d9c5c1062eff0034fb3ab120897a6c1b3ff7041" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:30:19.198Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_chunk() processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short Content-Length or a long run of whitespace can cause one call to read the remaining body into memory before the size check or spin on the event loop. A remote attacker can send such a multipart request to a handler that reads multipart data and bypass client_max_size. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-24c4-3p7v-29cm", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128128.json b/data/2026/128xxx/CVE-2026-128128.json new file mode 100644 index 0000000000..8559ad0389 --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128128.json @@ -0,0 +1,119 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128128", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.032Z", + "datePublished": "2026-11-13T20:31:59.981Z", + "dateUpdated": "2026-11-13T20:31:59.981Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: WebSocket max_msg_size bypass via integer overflow", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-770", + "lang": "en", + "description": "CWE-770: Allocation of Resources Without Limits or Throttling", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3rp8-rxj8-mvjw", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3rp8-rxj8-mvjw" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13415", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13415" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13494", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13494" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/8c8906a19f64e52ef6a7d44d65217eb3c5af413f", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/8c8906a19f64e52ef6a7d44d65217eb3c5af413f" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:31:59.981Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared frame length to the size of an already buffered partial message using signed 64-bit arithmetic. A length near two to the power of 63 can overflow, allowing the max_msg_size check to pass. A remote peer can send a small non-final fragment followed by an oversized message and cause unbounded memory consumption. The Python WebSocket reader is unaffected. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-3rp8-rxj8-mvjw", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128129.json b/data/2026/128xxx/CVE-2026-128129.json new file mode 100644 index 0000000000..4dd7ba0514 --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128129.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128129", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.032Z", + "datePublished": "2026-11-13T20:33:45.088Z", + "dateUpdated": "2026-11-13T20:33:45.088Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: Unbounded buffering of data received during an upgrade request", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-770", + "lang": "en", + "description": "CWE-770: Allocation of Resources Without Limits or Throttling", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pw86-h8fm-j323", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pw86-h8fm-j323" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13501", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13501" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13511", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13511" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/c207cadb257e0959b192ffca0548eca8c71eb96a", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/c207cadb257e0959b192ffca0548eca8c71eb96a" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:33:45.088Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-pw86-h8fm-j323", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128130.json b/data/2026/128xxx/CVE-2026-128130.json new file mode 100644 index 0000000000..5e89cc29c3 --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128130.json @@ -0,0 +1,132 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128130", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.032Z", + "datePublished": "2026-11-13T20:35:38.626Z", + "dateUpdated": "2026-11-13T20:35:38.626Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: Pure-Python parser request replay and buffer growth behind a declined upgrade", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-770", + "lang": "en", + "description": "CWE-770: Allocation of Resources Without Limits or Throttling", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-835", + "lang": "en", + "description": "CWE-835: Loop with Unreachable Exit Condition", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.3, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-28qf-cpwq-vmc2", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-28qf-cpwq-vmc2" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13356", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13356" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13360", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13360" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/72eaa429cf89b1e20212590f3e704444239569fb", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/72eaa429cf89b1e20212590f3e704444239569fb" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:35:38.626Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined request queue is full, the pure-Python parser stores the unparsed remainder internally and also returns the same data to its caller. After a handler declines an upgrade request, the caller feeds the remainder back to the parser, causing the buffer to grow with each handled request and dispatching already-handled requests to the application again. The issue affects deployments using AIOHTTP_NO_EXTENSIONS or otherwise running without the standard C-extension wheel, and can cause excessive memory use and repeated request processing. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-28qf-cpwq-vmc2", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128131.json b/data/2026/128xxx/CVE-2026-128131.json new file mode 100644 index 0000000000..4d434ebf2e --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128131.json @@ -0,0 +1,132 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128131", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.032Z", + "datePublished": "2026-11-13T20:39:46.745Z", + "dateUpdated": "2026-11-13T20:39:46.745Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: Concatenated compressed streams cause excessive CPU use", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-400", + "lang": "en", + "description": "CWE-400: Uncontrolled Resource Consumption", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-407", + "lang": "en", + "description": "CWE-407: Inefficient Algorithmic Complexity", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-h4cc-hm5h-fmm9", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-h4cc-hm5h-fmm9" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13362", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13362" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13391", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13391" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/d041d4d0fd48c3f0832084d33be16cf1c4835f85", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/d041d4d0fd48c3f0832084d33be16cf1c4835f85" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:39:46.745Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty members produce no output, so client_max_size and output backpressure do not limit the work. A remote attacker can block a server event loop with a crafted compressed request body or WebSocket message, and a malicious server can similarly block a client. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-h4cc-hm5h-fmm9", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128132.json b/data/2026/128xxx/CVE-2026-128132.json new file mode 100644 index 0000000000..ec48354ceb --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128132.json @@ -0,0 +1,146 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128132", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-11-12T22:42:47.032Z", + "datePublished": "2026-11-13T20:42:17.871Z", + "dateUpdated": "2026-11-13T20:42:17.871Z" + }, + "containers": { + "cna": { + "title": "AIOHTTP: WebSocket receive queue limits bypassed by small or compressed messages", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-400", + "lang": "en", + "description": "CWE-400: Uncontrolled Resource Consumption", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-770", + "lang": "en", + "description": "CWE-770: Allocation of Resources Without Limits or Throttling", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5rmc-48h2-hvcm", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5rmc-48h2-hvcm" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13393", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13393" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13545", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13545" + }, + { + "name": "https://github.com/aio-libs/aiohttp/pull/13546", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/pull/13546" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/5e54037933fa8422be5fa8a2002d118ed2d4e5e0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/5e54037933fa8422be5fa8a2002d118ed2d4e5e0" + }, + { + "name": "https://github.com/aio-libs/aiohttp/commit/b62321b6fa264a89f4aca084ad60fc38a59ffa51", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/commit/b62321b6fa264a89f4aca084ad60fc38a59ffa51" + }, + { + "name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4" + } + ], + "affected": [ + { + "vendor": "aio-libs", + "product": "aiohttp", + "versions": [ + { + "version": "< 3.14.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:42:17.871Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader continues parsing frames already received after the receive queue pauses the transport, and empty messages are not counted toward the queue size. With permessage-deflate, one read of compressed frames can add many megabytes of decompressed messages to the receive queue. A remote peer can send many small or compressed messages faster than the application consumes them and cause excessive memory use in a server or client. This issue is fixed in version 3.14.4." + } + ], + "source": { + "advisory": "GHSA-5rmc-48h2-hvcm", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128133.json b/data/2026/128xxx/CVE-2026-128133.json new file mode 100644 index 0000000000..b6381d8cad --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128133.json @@ -0,0 +1,31 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128133", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "REJECTED", + "dateReserved": "2026-11-12T22:42:47.032Z", + "dateUpdated": "2026-11-13T20:45:24.020Z", + "dateRejected": "2026-11-13T20:45:24.020Z", + "assignerShortName": "GitHub_M" + }, + "containers": { + "cna": { + "rejectedReasons": [ + { + "lang": "en", + "value": "This CVE is a duplicate of another CVE." + } + ], + "replacedBy": [ + "CVE-2026-126304" + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-13T20:45:24.020Z" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128885.json b/data/2026/128xxx/CVE-2026-128885.json new file mode 100644 index 0000000000..780da35d8d --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128885.json @@ -0,0 +1,121 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128885", + "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", + "state": "PUBLISHED", + "assignerShortName": "redhat", + "dateReserved": "2026-11-13T11:51:21.521Z", + "datePublished": "2026-11-13T21:06:46.450Z", + "dateUpdated": "2026-11-13T21:06:46.450Z" + }, + "containers": { + "cna": { + "title": "Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize", + "metrics": [ + { + "other": { + "content": { + "value": "Moderate", + "namespace": "https://access.redhat.com/security/updates/classification/" + }, + "type": "Red Hat severity rating" + } + }, + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "LOCAL", + "availabilityImpact": "HIGH", + "baseScore": 5.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" + }, + "format": "CVSS" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a large number of concurrent connections to trigger an out-of-bounds write on the stack. This can cause the daemon to crash, resulting in a Denial of Service (DoS)." + } + ], + "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dbus", + "defaultStatus": "unknown", + "cpes": [ + "cpe:/a:redhat:enterprise_linux:10" + ] + } + ], + "references": [ + { + "url": "https://access.redhat.com/security/cve/CVE-2026-128885", + "tags": [ + "vdb-entry", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462795", + "name": "RHBZ#2462795", + "tags": [ + "issue-tracking", + "x_refsource_REDHAT" + ] + } + ], + "datePublic": "2026-08-19T16:20:17.572Z", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-121", + "description": "Stack-based Buffer Overflow", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow", + "workarounds": [ + { + "lang": "en", + "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." + } + ], + "timeline": [ + { + "lang": "en", + "time": "2026-04-26T20:06:04.000Z", + "value": "Reported to Red Hat." + }, + { + "lang": "en", + "time": "2026-08-19T16:20:17.572Z", + "value": "Made public." + } + ], + "providerMetadata": { + "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", + "shortName": "redhat", + "dateUpdated": "2026-11-13T21:06:46.450Z" + }, + "x_generator": { + "engine": "cvelib 1.8.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128987.json b/data/2026/128xxx/CVE-2026-128987.json new file mode 100644 index 0000000000..4f848d6adb --- /dev/null +++ b/data/2026/128xxx/CVE-2026-128987.json @@ -0,0 +1,121 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-128987", + "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", + "state": "PUBLISHED", + "assignerShortName": "redhat", + "dateReserved": "2026-11-13T14:11:49.656Z", + "datePublished": "2026-11-13T21:06:55.820Z", + "dateUpdated": "2026-11-13T21:06:55.820Z" + }, + "containers": { + "cna": { + "title": "Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations", + "metrics": [ + { + "other": { + "content": { + "value": "Moderate", + "namespace": "https://access.redhat.com/security/updates/classification/" + }, + "type": "Red Hat severity rating" + } + }, + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "LOCAL", + "availabilityImpact": "HIGH", + "baseScore": 6.2, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" + }, + "format": "CVSS" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process." + } + ], + "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dbus", + "defaultStatus": "unknown", + "cpes": [ + "cpe:/a:redhat:enterprise_linux:10" + ] + } + ], + "references": [ + { + "url": "https://access.redhat.com/security/cve/CVE-2026-128987", + "tags": [ + "vdb-entry", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462869", + "name": "RHBZ#2462869", + "tags": [ + "issue-tracking", + "x_refsource_REDHAT" + ] + } + ], + "datePublic": "2026-08-19T16:20:17.572Z", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-835", + "description": "Loop with Unreachable Exit Condition", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "x_redhatCweChain": "CWE-835: Loop with Unreachable Exit Condition", + "workarounds": [ + { + "lang": "en", + "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." + } + ], + "timeline": [ + { + "lang": "en", + "time": "2026-04-26T20:18:03.000Z", + "value": "Reported to Red Hat." + }, + { + "lang": "en", + "time": "2026-08-19T16:20:17.572Z", + "value": "Made public." + } + ], + "providerMetadata": { + "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", + "shortName": "redhat", + "dateUpdated": "2026-11-13T21:06:55.820Z" + }, + "x_generator": { + "engine": "cvelib 1.8.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/128xxx/CVE-2026-128991.json b/data/2026/128xxx/CVE-2026-128991.json index f7cc41d301..0246a39341 100644 --- a/data/2026/128xxx/CVE-2026-128991.json +++ b/data/2026/128xxx/CVE-2026-128991.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T14:31:49.944Z", "datePublished": "2026-11-13T15:01:41.369Z", - "dateUpdated": "2026-11-13T15:01:41.369Z" + "dateUpdated": "2026-11-13T21:05:14.655Z" }, "containers": { "cna": { @@ -130,6 +130,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:05:06.274545Z", + "id": "CVE-2026-128991", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:05:14.655Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129099.json b/data/2026/129xxx/CVE-2026-129099.json index 3bbb7d2397..0e12a2db36 100644 --- a/data/2026/129xxx/CVE-2026-129099.json +++ b/data/2026/129xxx/CVE-2026-129099.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T15:31:00.206Z", "datePublished": "2026-11-13T15:38:32.150Z", - "dateUpdated": "2026-11-13T15:38:32.150Z" + "dateUpdated": "2026-11-13T21:06:21.146Z" }, "containers": { "cna": { @@ -122,6 +122,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:06:12.186428Z", + "id": "CVE-2026-129099", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:06:21.146Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129103.json b/data/2026/129xxx/CVE-2026-129103.json index 02b2ada863..abca562c38 100644 --- a/data/2026/129xxx/CVE-2026-129103.json +++ b/data/2026/129xxx/CVE-2026-129103.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T15:31:00.206Z", "datePublished": "2026-11-13T15:38:29.548Z", - "dateUpdated": "2026-11-13T15:38:29.548Z" + "dateUpdated": "2026-11-13T21:03:18.157Z" }, "containers": { "cna": { @@ -122,6 +122,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:03:09.734127Z", + "id": "CVE-2026-129103", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:03:18.157Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129119.json b/data/2026/129xxx/CVE-2026-129119.json index b1918f13f1..40a01cccb8 100644 --- a/data/2026/129xxx/CVE-2026-129119.json +++ b/data/2026/129xxx/CVE-2026-129119.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T16:00:59.324Z", "datePublished": "2026-11-13T16:23:46.712Z", - "dateUpdated": "2026-11-13T16:23:46.712Z" + "dateUpdated": "2026-11-13T21:12:21.062Z" }, "containers": { "cna": { @@ -142,6 +142,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:11:59.470857Z", + "id": "CVE-2026-129119", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:12:21.062Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129123.json b/data/2026/129xxx/CVE-2026-129123.json index d946569aeb..a7adb3cf0c 100644 --- a/data/2026/129xxx/CVE-2026-129123.json +++ b/data/2026/129xxx/CVE-2026-129123.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T16:01:00.787Z", "datePublished": "2026-11-13T16:23:43.967Z", - "dateUpdated": "2026-11-13T16:23:43.967Z" + "dateUpdated": "2026-11-13T21:11:40.850Z" }, "containers": { "cna": { @@ -148,6 +148,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:11:22.241547Z", + "id": "CVE-2026-129123", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:11:40.850Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129127.json b/data/2026/129xxx/CVE-2026-129127.json index f62f9c555e..1260ed179d 100644 --- a/data/2026/129xxx/CVE-2026-129127.json +++ b/data/2026/129xxx/CVE-2026-129127.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T16:01:02.227Z", "datePublished": "2026-11-13T16:23:41.139Z", - "dateUpdated": "2026-11-13T16:23:41.139Z" + "dateUpdated": "2026-11-13T21:11:02.627Z" }, "containers": { "cna": { @@ -148,6 +148,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:10:53.764446Z", + "id": "CVE-2026-129127", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:11:02.627Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129131.json b/data/2026/129xxx/CVE-2026-129131.json index a4f75f8caa..709942798d 100644 --- a/data/2026/129xxx/CVE-2026-129131.json +++ b/data/2026/129xxx/CVE-2026-129131.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T16:01:03.677Z", "datePublished": "2026-11-13T16:23:36.890Z", - "dateUpdated": "2026-11-13T16:23:36.890Z" + "dateUpdated": "2026-11-13T21:10:34.927Z" }, "containers": { "cna": { @@ -155,6 +155,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:10:27.213894Z", + "id": "CVE-2026-129131", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:10:34.927Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129135.json b/data/2026/129xxx/CVE-2026-129135.json index a6bf6a630f..3d2885eab1 100644 --- a/data/2026/129xxx/CVE-2026-129135.json +++ b/data/2026/129xxx/CVE-2026-129135.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T16:01:05.142Z", "datePublished": "2026-11-13T16:23:34.108Z", - "dateUpdated": "2026-11-13T16:23:34.108Z" + "dateUpdated": "2026-11-13T21:05:55.068Z" }, "containers": { "cna": { @@ -172,6 +172,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:05:47.021998Z", + "id": "CVE-2026-129135", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:05:55.068Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129152.json b/data/2026/129xxx/CVE-2026-129152.json index 1734eb0350..5e7fdced8d 100644 --- a/data/2026/129xxx/CVE-2026-129152.json +++ b/data/2026/129xxx/CVE-2026-129152.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T17:03:17.186Z", "datePublished": "2026-11-13T17:22:05.248Z", - "dateUpdated": "2026-11-13T17:22:05.248Z" + "dateUpdated": "2026-11-13T21:13:12.274Z" }, "containers": { "cna": { @@ -154,6 +154,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:13:04.156902Z", + "id": "CVE-2026-129152", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:13:12.274Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129156.json b/data/2026/129xxx/CVE-2026-129156.json index 956cd01210..c52549a152 100644 --- a/data/2026/129xxx/CVE-2026-129156.json +++ b/data/2026/129xxx/CVE-2026-129156.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T17:03:18.564Z", "datePublished": "2026-11-13T17:22:02.375Z", - "dateUpdated": "2026-11-13T17:22:02.375Z" + "dateUpdated": "2026-11-13T21:14:46.139Z" }, "containers": { "cna": { @@ -142,6 +142,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:14:38.744689Z", + "id": "CVE-2026-129156", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:14:46.139Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129161.json b/data/2026/129xxx/CVE-2026-129161.json index c1e1d42ad1..46c85cd8d1 100644 --- a/data/2026/129xxx/CVE-2026-129161.json +++ b/data/2026/129xxx/CVE-2026-129161.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T17:09:09.003Z", "datePublished": "2026-11-13T17:21:55.247Z", - "dateUpdated": "2026-11-13T17:21:55.247Z" + "dateUpdated": "2026-11-13T21:14:24.139Z" }, "containers": { "cna": { @@ -130,6 +130,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:14:15.248982Z", + "id": "CVE-2026-129161", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:14:24.139Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129165.json b/data/2026/129xxx/CVE-2026-129165.json index 1958c9b988..7159346e6c 100644 --- a/data/2026/129xxx/CVE-2026-129165.json +++ b/data/2026/129xxx/CVE-2026-129165.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T17:10:57.587Z", "datePublished": "2026-11-13T17:21:52.384Z", - "dateUpdated": "2026-11-13T17:21:52.384Z" + "dateUpdated": "2026-11-13T21:13:56.649Z" }, "containers": { "cna": { @@ -154,6 +154,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:13:48.840438Z", + "id": "CVE-2026-129165", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:13:56.649Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/129xxx/CVE-2026-129169.json b/data/2026/129xxx/CVE-2026-129169.json index 05c7260876..eaebc1ed8e 100644 --- a/data/2026/129xxx/CVE-2026-129169.json +++ b/data/2026/129xxx/CVE-2026-129169.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T17:11:54.526Z", "datePublished": "2026-11-13T17:21:49.628Z", - "dateUpdated": "2026-11-13T17:21:49.628Z" + "dateUpdated": "2026-11-13T21:13:36.371Z" }, "containers": { "cna": { @@ -142,6 +142,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:13:25.285322Z", + "id": "CVE-2026-129169", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:13:36.371Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/20xxx/CVE-2026-20320.json b/data/2026/20xxx/CVE-2026-20320.json index d05aafdc12..8180641f8a 100644 --- a/data/2026/20xxx/CVE-2026-20320.json +++ b/data/2026/20xxx/CVE-2026-20320.json @@ -8,19 +8,19 @@ "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.411Z", "datePublished": "2026-08-19T16:39:04.920Z", - "dateUpdated": "2026-11-11T04:55:47.088Z" + "dateUpdated": "2026-11-13T20:49:01.482Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", - "dateUpdated": "2026-08-19T16:39:04.920Z" + "dateUpdated": "2026-11-13T20:49:01.482Z" }, "descriptions": [ { "lang": "en", - "value": "A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.\r\n\r This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user." + "value": "A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. \r\n\r This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user." } ], "affected": [ @@ -75,7 +75,7 @@ "exploits": [ { "lang": "en", - "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." + "value": "In November 2026, this vulnerability was added to the Known Exploited Vulnerability (KEV) database of the U.S. Cybersecurity and Infrastructure Security Agency (CISA)." } ], "source": { diff --git a/data/2026/49xxx/CVE-2026-49990.json b/data/2026/49xxx/CVE-2026-49990.json index 353b9ad16a..835b22486e 100644 --- a/data/2026/49xxx/CVE-2026-49990.json +++ b/data/2026/49xxx/CVE-2026-49990.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-06-02T18:30:51.282Z", "datePublished": "2026-11-13T15:54:22.681Z", - "dateUpdated": "2026-11-13T15:54:22.681Z" + "dateUpdated": "2026-11-13T21:07:01.534Z" }, "containers": { "cna": { @@ -100,6 +100,48 @@ "advisory": "GHSA-8759-hx7g-94qx", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:06:41.375503Z", + "id": "CVE-2026-49990", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:07:01.534Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/52xxx/CVE-2026-52790.json b/data/2026/52xxx/CVE-2026-52790.json index 2f6532caa6..ec1a44f167 100644 --- a/data/2026/52xxx/CVE-2026-52790.json +++ b/data/2026/52xxx/CVE-2026-52790.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-06-08T18:02:19.731Z", "datePublished": "2026-11-13T15:57:10.497Z", - "dateUpdated": "2026-11-13T15:57:10.497Z" + "dateUpdated": "2026-11-13T21:07:45.249Z" }, "containers": { "cna": { @@ -104,6 +104,48 @@ "advisory": "GHSA-jr7p-rm2x-739x", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:07:26.266952Z", + "id": "CVE-2026-52790", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:07:45.249Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/62xxx/CVE-2026-62973.json b/data/2026/62xxx/CVE-2026-62973.json index 368abf7b9f..46a3581f7e 100644 --- a/data/2026/62xxx/CVE-2026-62973.json +++ b/data/2026/62xxx/CVE-2026-62973.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T22:48:09.780Z", "datePublished": "2026-11-13T15:59:09.431Z", - "dateUpdated": "2026-11-13T15:59:09.431Z" + "dateUpdated": "2026-11-13T21:08:56.151Z" }, "containers": { "cna": { @@ -94,6 +94,48 @@ "advisory": "GHSA-3xxw-jfwm-rq9c", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:08:38.040564Z", + "id": "CVE-2026-62973", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:08:56.151Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/63xxx/CVE-2026-63164.json b/data/2026/63xxx/CVE-2026-63164.json index 38e1d82095..91c758c35d 100644 --- a/data/2026/63xxx/CVE-2026-63164.json +++ b/data/2026/63xxx/CVE-2026-63164.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-07-15T21:18:20.186Z", "datePublished": "2026-11-13T17:02:42.943Z", - "dateUpdated": "2026-11-13T17:21:47.515Z" + "dateUpdated": "2026-11-13T21:12:40.343Z" }, "containers": { "cna": { @@ -170,6 +170,40 @@ "x_generator": { "engine": "vulncheck" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:12:32.921328Z", + "id": "CVE-2026-63164", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:12:40.343Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/63xxx/CVE-2026-63173.json b/data/2026/63xxx/CVE-2026-63173.json index 50b0d2d066..0dc29e0d8d 100644 --- a/data/2026/63xxx/CVE-2026-63173.json +++ b/data/2026/63xxx/CVE-2026-63173.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-07-15T21:18:20.187Z", "datePublished": "2026-11-13T17:08:32.475Z", - "dateUpdated": "2026-11-13T17:24:57.138Z" + "dateUpdated": "2026-11-13T21:09:50.025Z" }, "containers": { "cna": { @@ -170,6 +170,40 @@ "x_generator": { "engine": "vulncheck" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:09:42.317148Z", + "id": "CVE-2026-63173", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:09:50.025Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/71xxx/CVE-2026-71972.json b/data/2026/71xxx/CVE-2026-71972.json index 845003b1fa..344a383f0c 100644 --- a/data/2026/71xxx/CVE-2026-71972.json +++ b/data/2026/71xxx/CVE-2026-71972.json @@ -8,23 +8,23 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-08-08T16:43:04.178Z", "datePublished": "2026-09-29T21:29:20.688Z", - "dateUpdated": "2026-09-30T14:10:40.135Z" + "dateUpdated": "2026-11-13T20:20:18.073Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", - "dateUpdated": "2026-09-29T21:29:20.688Z" + "dateUpdated": "2026-11-13T20:20:18.073Z" }, - "datePublic": "2026-07-29T00:00:00.000Z", - "title": "U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder", + "title": "U-Boot < 2027.01-rc1 Out-of-Bounds Write in BMP RLE8 Decoder", "descriptions": [ { "lang": "en", - "value": "U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader." + "value": "U-Boot before 2027.01-rc1 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader." } ], + "datePublic": "2026-07-29T00:00:00.000Z", "problemTypes": [ { "descriptions": [ @@ -47,9 +47,9 @@ "versions": [ { "version": "0", - "lessThanOrEqual": "2026.10-rc5", "status": "affected", - "versionType": "custom" + "versionType": "custom", + "lessThan": "2027.01-rc1" } ] } @@ -59,12 +59,11 @@ "nodes": [ { "operator": "OR", - "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*", - "versionEndIncluding": "2026.10-rc5" + "versionEndExcluding": "2027.01-rc1" } ] } @@ -74,29 +73,46 @@ "metrics": [ { "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], "cvssV4_0": { - "version": "4.0", - "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", - "vulnIntegrityImpact": "LOW", - "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "MEDIUM", "baseScore": 6, - "baseSeverity": "MEDIUM" + "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N" } }, { "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], "cvssV3_1": { - "version": "3.1", - "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", @@ -105,8 +121,10 @@ "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", + "version": "3.1", + "baseSeverity": "MEDIUM", "baseScore": 5.9, - "baseSeverity": "MEDIUM" + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H" } } ], @@ -123,18 +141,19 @@ "technical-description" ] }, - { - "url": "https://github.com/u-boot/u-boot", - "tags": [ - "product" - ] - }, { "name": "VulnCheck Advisory: U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder", "tags": [ "third-party-advisory" ], "url": "https://www.vulncheck.com/advisories/u-boot-through-2026.10-rc5-out-of-bounds-write-in-bmp-rle8-decoder" + }, + { + "url": "https://www.legacymind.de/en/knowledge/u-boot-cves#cve-2026-71972", + "name": "LegacyMind Advisory", + "tags": [ + "third-party-advisory" + ] } ], "credits": [ diff --git a/data/2026/75xxx/CVE-2026-75490.json b/data/2026/75xxx/CVE-2026-75490.json index db781f5bbb..21e99439d4 100644 --- a/data/2026/75xxx/CVE-2026-75490.json +++ b/data/2026/75xxx/CVE-2026-75490.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-08-17T20:07:25.283Z", "datePublished": "2026-11-13T09:36:57.148Z", - "dateUpdated": "2026-11-13T09:36:57.148Z" + "dateUpdated": "2026-11-13T20:35:49.304Z" }, "containers": { "cna": { @@ -122,6 +122,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:35:39.684245Z", + "id": "CVE-2026-75490", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:35:49.304Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/75xxx/CVE-2026-75494.json b/data/2026/75xxx/CVE-2026-75494.json index 7c8b8d5283..200ce57855 100644 --- a/data/2026/75xxx/CVE-2026-75494.json +++ b/data/2026/75xxx/CVE-2026-75494.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-08-17T20:07:25.283Z", "datePublished": "2026-11-13T09:36:54.477Z", - "dateUpdated": "2026-11-13T09:36:54.477Z" + "dateUpdated": "2026-11-13T20:36:20.984Z" }, "containers": { "cna": { @@ -129,6 +129,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:36:09.224087Z", + "id": "CVE-2026-75494", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:36:20.984Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/75xxx/CVE-2026-75578.json b/data/2026/75xxx/CVE-2026-75578.json index c3bca055ad..e9589ef02e 100644 --- a/data/2026/75xxx/CVE-2026-75578.json +++ b/data/2026/75xxx/CVE-2026-75578.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-08-17T22:02:43.612Z", "datePublished": "2026-11-13T09:36:51.764Z", - "dateUpdated": "2026-11-13T09:36:51.764Z" + "dateUpdated": "2026-11-13T20:36:50.993Z" }, "containers": { "cna": { @@ -129,6 +129,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T20:36:37.538745Z", + "id": "CVE-2026-75578", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T20:36:50.993Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/82xxx/CVE-2026-82504.json b/data/2026/82xxx/CVE-2026-82504.json new file mode 100644 index 0000000000..409dcbf725 --- /dev/null +++ b/data/2026/82xxx/CVE-2026-82504.json @@ -0,0 +1,158 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-82504", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-08-29T17:20:57.079Z", + "datePublished": "2026-11-13T20:45:22.836Z", + "dateUpdated": "2026-11-13T20:45:22.836Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-13T20:45:22.836Z" + }, + "title": "VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx", + "descriptions": [ + { + "lang": "en", + "value": "VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+." + } + ], + "datePublic": "2026-11-13T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Unrestricted Upload of File with Dangerous Type", + "cweId": "CWE-434", + "type": "CWE" + }, + { + "lang": "en", + "description": "Missing Authentication for Critical Function", + "cweId": "CWE-306", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "defaultStatus": "unaffected", + "vendor": "VITEC", + "product": "EZ TV Platform Server", + "versions": [ + { + "status": "affected", + "version": "0", + "versionType": "semver", + "lessThan": "8.5.0" + }, + { + "status": "unaffected", + "version": "8.5.0", + "versionType": "semver" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "CRITICAL", + "baseScore": 9.3, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "version": "3.1", + "baseSeverity": "CRITICAL", + "baseScore": 9.8, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + } + ], + "references": [ + { + "url": "https://www.vitec.com/dl/vitec-ez-tv-platform-datasheet", + "name": "VITEC Product Document", + "tags": [ + "product" + ] + }, + { + "url": "https://www.vulncheck.com/advisories/vitec-ez-tv-platform-server-unauthenticated-file-upload-via-uploadhandler-ashx", + "name": "VulnCheck Advisory: VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx", + "tags": [ + "third-party-advisory" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Daly Whyte (Solusec Ltd)", + "type": "finder" + } + ], + "solutions": [ + { + "lang": "en", + "value": "All customers on an EZ TV Platform Server Version prior to 8.5.0 should contact the Vitec Helpdesk immediately to schedule patch or upgrade." + } + ], + "x_generator": { + "engine": "vulncheck" + } + } + } +} \ No newline at end of file diff --git a/data/2026/89xxx/CVE-2026-89037.json b/data/2026/89xxx/CVE-2026-89037.json new file mode 100644 index 0000000000..1890e9cfbc --- /dev/null +++ b/data/2026/89xxx/CVE-2026-89037.json @@ -0,0 +1,154 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-89037", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-09-10T16:23:54.472Z", + "datePublished": "2026-11-13T20:26:25.327Z", + "dateUpdated": "2026-11-13T20:26:25.327Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-13T20:26:25.327Z" + }, + "title": "Dolibarr < 24.0.2 IDOR via Ticket Documents API", + "descriptions": [ + { + "lang": "en", + "value": "Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties." + } + ], + "tags": [ + "x_open-source" + ], + "datePublic": "2026-09-15T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Authorization Bypass Through User-Controlled Key", + "cweId": "CWE-639", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "defaultStatus": "unaffected", + "vendor": "Dolibarr", + "product": "dolibarr", + "packageURL": "pkg:github/Dolibarr/dolibarr", + "repo": "https://github.com/Dolibarr/dolibarr", + "versions": [ + { + "status": "affected", + "version": "0", + "versionType": "semver", + "lessThan": "24.0.2" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 7.1, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "version": "3.1", + "baseSeverity": "MEDIUM", + "baseScore": 6.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + } + ], + "references": [ + { + "url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.2", + "name": "Release Notes", + "tags": [ + "release-notes" + ] + }, + { + "url": "https://github.com/Dolibarr/dolibarr/commit/f815deb1c234168a69623101a26ae71f8c384c46", + "name": "Patch Commit", + "tags": [ + "patch", + "issue-tracking" + ] + }, + { + "url": "https://www.vulncheck.com/advisories/dolibarr-idor-via-ticket-documents-api", + "name": "VulnCheck Advisory: Dolibarr < 24.0.2 IDOR via Ticket Documents API", + "tags": [ + "third-party-advisory" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "ThuongTPH", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck" + } + } + } +} \ No newline at end of file diff --git a/data/2026/92xxx/CVE-2026-92735.json b/data/2026/92xxx/CVE-2026-92735.json index 732cdcbcc8..489c33cdfa 100644 --- a/data/2026/92xxx/CVE-2026-92735.json +++ b/data/2026/92xxx/CVE-2026-92735.json @@ -8,7 +8,7 @@ "assignerShortName": "HashiCorp", "dateReserved": "2026-09-16T18:24:56.213Z", "datePublished": "2026-11-12T22:31:44.506Z", - "dateUpdated": "2026-11-13T13:48:31.203Z" + "dateUpdated": "2026-11-13T21:14:35.797Z" }, "containers": { "cna": { @@ -152,6 +152,40 @@ "discovery": "EXTERNAL" }, "title": "Vault integrated storage join may disclose server environment credentials" - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-13T21:14:27.215510Z", + "id": "CVE-2026-92735", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-13T21:14:35.797Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/92xxx/CVE-2026-92738.json b/data/2026/92xxx/CVE-2026-92738.json new file mode 100644 index 0000000000..df68473552 --- /dev/null +++ b/data/2026/92xxx/CVE-2026-92738.json @@ -0,0 +1,191 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-92738", + "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", + "state": "PUBLISHED", + "assignerShortName": "HashiCorp", + "dateReserved": "2026-09-16T18:24:56.544Z", + "datePublished": "2026-11-13T20:23:30.733Z", + "dateUpdated": "2026-11-13T21:09:35.483Z" + }, + "containers": { + "cna": { + "affected": [ + { + "defaultStatus": "unaffected", + "platforms": [ + "64 bit", + "32 bit", + "x86", + "ARM", + "MacOS", + "Windows", + "Linux" + ], + "product": "Vault", + "repo": "https://github.com/hashicorp/vault", + "vendor": "HashiCorp", + "versions": [ + { + "lessThan": "2.2.2", + "status": "affected", + "version": "1.10.0", + "versionType": "semver" + } + ] + }, + { + "defaultStatus": "unaffected", + "platforms": [ + "64 bit", + "32 bit", + "x86", + "ARM", + "MacOS", + "Windows", + "Linux" + ], + "product": "Vault Enterprise", + "repo": "https://github.com/hashicorp/vault", + "vendor": "HashiCorp", + "versions": [ + { + "changes": [ + { + "at": "1.19.26", + "status": "unaffected" + }, + { + "at": "1.20.0", + "status": "affected" + }, + { + "at": "1.21.14", + "status": "unaffected" + }, + { + "at": "2.0.0", + "status": "affected" + } + ], + "lessThan": "2.2.2", + "status": "affected", + "version": "1.10.0", + "versionType": "semver" + } + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "This issue was identified by an external party who reported it to HashiCorp." + } + ], + "descriptions": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.