Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.
An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.
This issue affects hex: from 0.16.0 before 2.4.2.
" + "value": "Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.
Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.
An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.
This issue affects hex: from 0.16.0 before 2.4.2.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Insufficient Verification of Data Authenticity vulnerability in hexpm hex (`Hex.RemoteConverger` module) allows dependency integrity bypass via unverified lockfile checksums.\n\nHex stores checksums for dependencies in the `mix.lock` file to ensure reproducible and integrity-checked builds. However, `Hex.RemoteConverger.verify_resolved/2` never executes checksum verification because the lock data returned by `Hex.Utils.lock/1` uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.\n\nAn attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The `mix.lock` file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.\n\nThis issue affects hex: from 0.16.0 before 2.4.2." } ], "value": "Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.\n\nHex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.\n\nAn attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.\n\nThis issue affects hex: from 0.16.0 before 2.4.2." } ], + "impacts": [ + { + "capecId": "CAPEC-185", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-185 Malicious Software Download" + } + ] + } + ], "metrics": [ { "cvssV4_0": { @@ -135,7 +152,6 @@ "attackVector": "NETWORK", "baseScore": 8.9, "baseSeverity": "HIGH", - "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", @@ -184,10 +200,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-05-01T04:33:38.198Z" + "dateUpdated": "2026-11-11T19:17:12.374Z" }, "references": [ { + "name": "Lockfile checksums not verified in Hex allows dependency integrity bypass", "tags": [ "vendor-advisory", "related" @@ -195,18 +212,28 @@ "url": "https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v" }, { + "name": "EEF CNA record for CVE-2026-32148", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-32148.html" }, { + "name": "OSV record EEF-CVE-2026-32148", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32148" }, { + "name": "Introducing commit e01576f in hexpm/hex", + "tags": [ + "related" + ], + "url": "https://github.com/hexpm/hex/commit/e01576f28c64af9fae6eb17e2dad30f6efcb303c" + }, + { + "name": "Fix commit d7528c8 in hexpm/hex", "tags": [ "patch" ], @@ -216,10 +243,7 @@ "source": { "discovery": "EXTERNAL" }, - "title": "Lockfile checksums not verified in Hex allows dependency integrity bypass", - "x_generator": { - "engine": "cvelib 1.8.0" - } + "title": "Lockfile checksums not verified in Hex allows dependency integrity bypass" }, "adp": [ { diff --git a/data/2026/40xxx/CVE-2026-40853.json b/data/2026/40xxx/CVE-2026-40853.json index 5f1a905345..8127e51e5a 100644 --- a/data/2026/40xxx/CVE-2026-40853.json +++ b/data/2026/40xxx/CVE-2026-40853.json @@ -8,7 +8,7 @@ "assignerShortName": "apache", "dateReserved": "2026-04-15T09:36:04.823Z", "datePublished": "2026-11-11T13:16:13.608Z", - "dateUpdated": "2026-11-11T13:16:13.608Z" + "dateUpdated": "2026-11-11T19:05:28.615Z" }, "containers": { "cna": { @@ -94,6 +94,21 @@ "x_generator": { "engine": "Vulnogram 0.2.0" } - } + }, + "adp": [ + { + "title": "CVE Program Container", + "references": [ + { + "url": "http://www.openwall.com/lists/oss-security/2026/11/11/16" + } + ], + "providerMetadata": { + "orgId": "af854a3a-2127-422b-91ae-364da2661108", + "shortName": "CVE", + "dateUpdated": "2026-11-11T19:05:28.615Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/42xxx/CVE-2026-42790.json b/data/2026/42xxx/CVE-2026-42790.json index 212da3fc3c..d4abf9765a 100644 --- a/data/2026/42xxx/CVE-2026-42790.json +++ b/data/2026/42xxx/CVE-2026-42790.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-04-29T18:06:33.251Z", "datePublished": "2026-05-27T15:09:01.860Z", - "dateUpdated": "2026-09-18T12:04:51.323Z" + "dateUpdated": "2026-11-11T19:13:56.207Z" }, "containers": { "cna": { @@ -17,13 +17,65 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unknown", + "defaultStatus": "unaffected", + "modules": [ + "pubkey_cert", + "public_key" + ], + "packageName": "otp", + "packageURL": "pkg:software-id/erlang.org/otp", + "product": "OTP", + "programFiles": [ + "lib/public_key/src/pubkey_cert.erl", + "lib/public_key/src/public_key.erl" + ], + "programRoutines": [ + { + "name": "pubkey_cert:validate_names/6" + }, + { + "name": "public_key:pkix_verify_hostname/3" + } + ], + "vendor": "Erlang", + "versions": [ + { + "changes": [ + { + "at": "26.2.5.21", + "status": "unaffected" + }, + { + "at": "27.3.4.12", + "status": "unaffected" + }, + { + "at": "28.5.0.1", + "status": "unaffected" + }, + { + "at": "29.0.1", + "status": "unaffected" + } + ], + "lessThan": "*", + "status": "affected", + "version": "19.3", + "versionType": "otp" + } + ] + }, + { + "cpes": [ + "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", "modules": [ "pubkey_cert", "public_key" ], "packageName": "public_key", - "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", + "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/pubkey_cert.erl", @@ -71,7 +123,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unknown", + "defaultStatus": "unaffected", "modules": [ "pubkey_cert", "public_key" @@ -94,30 +146,6 @@ "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ - { - "changes": [ - { - "at": "26.2.5.21", - "status": "unaffected" - }, - { - "at": "27.3.4.12", - "status": "unaffected" - }, - { - "at": "28.5.0.1", - "status": "unaffected" - }, - { - "at": "29.0.1", - "status": "unaffected" - } - ], - "lessThan": "*", - "status": "affected", - "version": "19.3", - "versionType": "otp" - }, { "changes": [ { @@ -200,6 +228,7 @@ "value": "Jakub Witczak" } ], + "datePublic": "2026-05-27T15:09:01.000Z", "descriptions": [ { "lang": "en", @@ -207,10 +236,15 @@ { "base64": false, "type": "text/html", - "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com):
First, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName.
Second, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback.
The result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher.
This issue affects OTP from OTP 19.3 before OTP 29.0.1, OTP 28.5.0.1, OTP 27.3.4.12 and OTP 26.2.5.21, corresponding to public_key from 1.4 before 1.21.1, 1.20.3.1, 1.17.1.3 and 1.15.1.7.
" + "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.
Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com):
First, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName.
Second, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback.
The result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher.
This issue affects OTP from OTP 19.3 before OTP 26.2.5.21, OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 1.4 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.21.1.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Improper Certificate Validation vulnerability in Erlang OTP `public_key` (`pubkey_cert` and `public_key` modules) allows a DNS `nameConstraints` bypass via subject CommonName fallback in TLS hostname verification.\n\nTwo flaws combine to allow a subordinate CA whose DNS `nameConstraints` are restricted (e.g. `permitted;DNS:allowed.example.com`) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. `victim.example.com`):\n\nFirst, `pubkey_cert:validate_names/6` in `lib/public_key/src/pubkey_cert.erl` only checks SAN DNS entries against `nameConstraints`. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no `subjectAltName` therefore trivially satisfies any `permitted;DNS:...` constraint regardless of its subject `commonName`.\n\nSecond, `public_key:pkix_verify_hostname/3` in `lib/public_key/src/public_key.erl` falls back to the subject `commonName` when no `subjectAltName` is present, extracting `id-at-commonName` attributes as presented IDs and matching them against the reference hostname. The strict `pkix_verify_hostname_match_fun(https)` matcher does not suppress this fallback.\n\nThe result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the `nameConstraints` are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock `ssl:connect` with `verify_peer`, a trusted CA, SNI, and the canonical strict `https` hostname matcher.\n\nThis issue affects OTP from OTP 19.3 before OTP 26.2.5.21, OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 1.4 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.21.1." } ], - "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.\n\nTwo flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com):\n\nFirst, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName.\n\nSecond, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback.\n\nThe result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher.\n\nThis issue affects OTP from OTP 19.3 before OTP 29.0.1, OTP 28.5.0.1, OTP 27.3.4.12 and OTP 26.2.5.21, corresponding to public_key from 1.4 before 1.21.1, 1.20.3.1, 1.17.1.3 and 1.15.1.7." + "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.\n\nTwo flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com):\n\nFirst, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName.\n\nSecond, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback.\n\nThe result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher.\n\nThis issue affects OTP from OTP 19.3 before OTP 26.2.5.21, OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 1.4 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.21.1." } ], "impacts": [ @@ -227,21 +261,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.6, "baseSeverity": "HIGH", "privilegesRequired": "NONE", + "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", - "vulnIntegrityImpact": "HIGH" + "vulnIntegrityImpact": "HIGH", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -260,7 +300,11 @@ "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE" - }, + } + ] + }, + { + "descriptions": [ { "cweId": "CWE-297", "description": "CWE-297 Improper Validation of Certificate with Host Mismatch", @@ -273,10 +317,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-24T14:16:36.818Z" + "dateUpdated": "2026-11-11T19:13:56.207Z" }, "references": [ { + "name": "Name Constraints and Subject CommonName Fallback in TLS hostname Verification", "tags": [ "vendor-advisory", "related" @@ -284,36 +329,49 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447" }, { + "name": "EEF CNA record for CVE-2026-42790", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-42790.html" }, { + "name": "OSV record EEF-CVE-2026-42790", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-42790" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit b0c245e in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/b0c245e8132bb13171e277b1af59c0cec00c9459" + }, + { + "name": "Fix commit 0769050 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/0769050c69d73762672b0db1347b6993a5b31759" }, { + "name": "Fix commit fb67c6d in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457" }, { + "name": "Fix commit 21abed6 in erlang/otp", "tags": [ "patch" ], @@ -331,15 +389,17 @@ { "base64": false, "type": "text/html", - "value": "The verify_fun option in the ssl application can be used to ensure that TLS connections fail if the end-entity certificate is missing the subjectAltName extension or has no domain name. Do not use a verify_fun that accepts the name_not_permitted error." + "value": "The verify_fun option in the ssl application can be used to ensure that TLS connections fail if the end-entity certificate is missing the subjectAltName extension or has no domain name. Do not use a verify_fun that accepts the name_not_permitted error.
Applications calling public_key:pkix_ocsp_validate/5 directly are unconditionally affected when that function is used.
" + "value": "For the ssl application, OCSP stapling must be enabled by setting the stapling option to staple in the TLS client options. OCSP stapling is not enabled by default.
Applications calling public_key:pkix_ocsp_validate/5 directly are unconditionally affected when that function is used.
OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.
This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.
This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.
" + "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.
OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.
This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.
This issue affects OTP from OTP 27.0 before OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 1.16 before 1.17.1.3, 1.20.3.1, and 1.21.1.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Improper Certificate Validation vulnerability in Erlang OTP `public_key` (`pubkey_ocsp` module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.\n\nOCSP response verification in `pubkey_ocsp:verify_response/5` and `pubkey_ocsp:is_authorized_responder/3` in `lib/public_key/src/pubkey_ocsp.erl` does not check the validity period (`notBefore`/`notAfter`) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.\n\nThis affects TLS clients using OCSP stapling via the `ssl` application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling `public_key:pkix_ocsp_validate/5` directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.\n\nThis issue affects OTP from OTP 27.0 before OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 1.16 before 1.17.1.3, 1.20.3.1, and 1.21.1." } ], - "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.\n\nOCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.\n\nThis affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3." + "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.\n\nOCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.\n\nThis affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.\n\nThis issue affects OTP from OTP 27.0 before OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 1.16 before 1.17.1.3, 1.20.3.1, and 1.21.1." } ], "impacts": [ @@ -208,21 +245,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", + "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", - "vulnIntegrityImpact": "LOW" + "vulnIntegrityImpact": "LOW", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -241,7 +284,11 @@ "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE" - }, + } + ] + }, + { + "descriptions": [ { "cweId": "CWE-672", "description": "CWE-672 Operation on a Resource after Expiration or Release", @@ -254,10 +301,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-24T14:14:24.911Z" + "dateUpdated": "2026-11-11T19:11:15.974Z" }, "references": [ { + "name": "OCSP Responder Certificate Accepted After Expiry in public_key", "tags": [ "vendor-advisory", "related" @@ -265,30 +313,42 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-cjxj-wj6x-3fff" }, { + "name": "EEF CNA record for CVE-2026-42791", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-42791.html" }, { + "name": "OSV record EEF-CVE-2026-42791", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-42791" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit 2b1a742 in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/2b1a742c651b90f8a7a1fb2ddde73f29915ea376" + }, + { + "name": "Fix commit 7995f1f in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/7995f1fdaee3da569bb810358ce0f546471d169b" }, { + "name": "Fix commit b3870e0 in erlang/otp", "tags": [ "patch" ], @@ -306,15 +366,17 @@ { "base64": false, "type": "text/html", - "value": "ssl application, disable OCSP stapling by setting {stapling, no_staple} in the client options, or switch to CRL-based revocation checking with {crl_check, true}.public_key:pkix_ocsp_validate/5 directly, validate the responder certificate's validity period in application code before calling the function.The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.
On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover.
This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.
" + "value": "Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.
The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.
On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 6.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Improper Handling of Exceptional Conditions vulnerability in Erlang OTP `erts` (`epmd`) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.\n\nThe `do_accept` function in `erts/epmd/src/epmd_srv.c` calls `epmd_cleanup_exit()` when `accept(2)` returns `EMFILE` (per-process file descriptor limit reached) or `ENFILE` (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing `accept(2)` to return `EMFILE`, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.\n\nOn Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both `epmd.service` and `epmd.socket` and requiring manual operator intervention to recover.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 6.0 before 15.2.7.11, 16.4.0.4, and 17.0.4." } ], - "value": "Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.\n\nThe do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.\n\nOn Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover.\n\nThis issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15." + "value": "Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.\n\nThe do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.\n\nOn Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 6.0 before 15.2.7.11, 16.4.0.4, and 17.0.4." } ], "impacts": [ @@ -178,21 +208,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", + "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", - "vulnIntegrityImpact": "NONE" + "vulnIntegrityImpact": "NONE", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -211,7 +247,11 @@ "description": "CWE-755 Improper Handling of Exceptional Conditions", "lang": "en", "type": "CWE" - }, + } + ] + }, + { + "descriptions": [ { "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", @@ -224,10 +264,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-28T09:55:23.932Z" + "dateUpdated": "2026-11-11T19:09:12.847Z" }, "references": [ { + "name": "epmd: Denial-of-service via accept(EMFILE)", "tags": [ "vendor-advisory", "related" @@ -235,24 +276,35 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6" }, { + "name": "EEF CNA record for CVE-2026-42792", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-42792.html" }, { + "name": "OSV record EEF-CVE-2026-42792", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-42792" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit 07b8f44 in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79" + }, + { + "name": "Fix commit 865d203 in erlang/otp", "tags": [ "patch" ], @@ -270,15 +322,17 @@ { "base64": false, "type": "text/html", - "value": "ListenStream= (empty, to clear), then ListenStream=127.0.0.1:4369 and ListenStream=[::1]:4369 in /etc/systemd/system/epmd.socket.d/override.conf.LimitNOFILE=65536 and Restart=always with a suitable RestartSec in /etc/systemd/system/epmd.service.d/override.conf.The vulnerable path is active under the default configuration: mode=passive, ipfamily=inet, and ftp_extension=false are all defaults for ftp:open/2.
Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.
The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.
The vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.
The ftp application is deprecated and scheduled for removal in OTP-30.
This vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later).
This issue affects OTP from OTP 17.4 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to inets from 5.10.4 before 7.0 and ftp from 1.0 before 1.2.6, 1.2.4.1 and 1.2.3.1.
" + "value": "Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.
\nThe ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.
The vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.
\nThe ftp application is deprecated and scheduled for removal in OTP-30.
This vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later).
This issue affects OTP from OTP 17.4 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to inets from 5.10.4 before 7.0, and ftp from 1.0 before 1.2.3.1, 1.2.4.1, and 1.2.6.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.\n\nThe `ftp_internal:handle_ctrl_result/2` PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to `gen_tcp:connect/4` without validating it against the control connection peer address. The adjacent EPSV handlers correctly call `peername(CSock)` to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (`ftp:ls/1,2`, `ftp:nlist/1,2`, `ftp:recv/2,3`), data from the redirected target is returned to the caller. On write operations (`ftp:send/2,3`, `ftp:append/2,3`), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.\n\nThe vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.\n\nThe `ftp` application is deprecated and scheduled for removal in OTP-30.\n\nThis vulnerability is associated with program files `lib/inets/src/ftp/ftp_internal.erl` (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and `lib/ftp/src/ftp_internal.erl` (ftp 1.0 and later, OTP 21.0 and later).\n\nThis issue affects OTP from OTP 17.4 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to inets from 5.10.4 before 7.0, and ftp from 1.0 before 1.2.3.1, 1.2.4.1, and 1.2.6." } ], - "value": "Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.\n\nThe ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.\n\nThe vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.\n\nThe ftp application is deprecated and scheduled for removal in OTP-30.\n\nThis vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later).\n\nThis issue affects OTP from OTP 17.4 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to inets from 5.10.4 before 7.0 and ftp from 1.0 before 1.2.6, 1.2.4.1 and 1.2.3.1." + "value": "Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.\n\nThe ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.\n\nThe vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.\n\nThe ftp application is deprecated and scheduled for removal in OTP-30.\n\nThis vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later).\n\nThis issue affects OTP from OTP 17.4 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to inets from 5.10.4 before 7.0, and ftp from 1.0 before 1.2.3.1, 1.2.4.1, and 1.2.6." } ], "impacts": [ @@ -237,21 +273,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", + "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", - "vulnIntegrityImpact": "LOW" + "vulnIntegrityImpact": "LOW", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -267,7 +309,7 @@ "descriptions": [ { "cweId": "CWE-918", - "description": "CWE-918 Server-Side Request Forgery (SSRF)", + "description": "CWE-918 Server-Side Request Forgery", "lang": "en", "type": "CWE" } @@ -277,10 +319,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-24T14:16:02.204Z" + "dateUpdated": "2026-11-11T19:05:09.624Z" }, "references": [ { + "name": "FTP Client PASV Response IP not Validated Against Control Peer, Enabling SSRF and FTP Bounce Attacks", "tags": [ "vendor-advisory", "related" @@ -288,34 +331,46 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-24cv-hwgr-37fq" }, { + "name": "EEF CNA record for CVE-2026-48858", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-48858.html" }, { + "name": "OSV record EEF-CVE-2026-48858", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48858" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit be95772 in erlang/otp", "tags": [ - "patch" + "related" ], - "url": "https://github.com/erlang/otp/commit/2691a806231ffd0490a8a9e20500dec0c7e73727" + "url": "https://github.com/erlang/otp/commit/be95772ee1fcfe71045ef070130bea7a910b81e3" }, { + "name": "Fix commit 521bcfa in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/521bcfa24407ee8cb5614823cf905c37ea3aa605" + }, + { + "name": "Fix commit 2691a80 in erlang/otp", + "tags": [ + "patch" + ], + "url": "https://github.com/erlang/otp/commit/2691a806231ffd0490a8a9e20500dec0c7e73727" } ], "source": { @@ -329,15 +384,17 @@ { "base64": false, "type": "text/html", - "value": "Pass {ftp_extension, true} to ftp:open/2 to use EPSV instead of PASV. Alternatively, pass {mode, active} to use active mode, or pass {ipfamily, inet6} to force IPv6, both of which bypass the vulnerable PASV path." + "value": "Pass {ftp_extension, true} to ftp:open/2 to use EPSV instead of PASV. Alternatively, pass {mode, active} to use active mode, or pass {ipfamily, inet6} to force IPv6, both of which bypass the vulnerable PASV path.
The SFTP subsystem must be configured with the root option in ssh_sftpd:subsystem_spec/1, and the operator must rely on it to provide filesystem path isolation. The root option is not set by default.
" + "value": "The SFTP subsystem must be configured with the root option in ssh_sftpd:subsystem_spec/1, and the operator must rely on it to provide filesystem path isolation. The root option is not set by default.
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.
The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.
An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.
The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.
This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.
This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.
" + "value": "Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.
The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.
An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.
The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.
\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssh from 3.0.1 before 5.2.11.9, 5.5.2.2, and 6.0.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Observable Response Discrepancy vulnerability in Erlang OTP `ssh` (`ssh_sftpd` module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.\n\nThe `SSH_FXP_REALPATH` handler in `ssh_sftpd` calls `relate_file_name/3` with `Canonicalize=false`, unlike every other SFTP operation handler. This allows `..` components in the requested path to bypass the `is_within_root/2` check without being resolved. The un-canonicalized path then enters `resolve_symlinks/2`, which walks up the directory tree above the configured root and issues `read_link()` syscalls on arbitrary filesystem paths.\n\nAn authenticated SFTP client can exploit this by sending a `REALPATH` request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (`SSH_FXP_NAME` when the path resolves successfully, `SSH_FX_NO_SUCH_FILE` when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.\n\nThe vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl` and program routine `ssh_sftpd:handle_op/4`.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssh from 3.0.1 before 5.2.11.9, 5.5.2.2, and 6.0.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown." } ], - "value": "Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.\n\nThe SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.\n\nAn authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.\n\nThe vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9." + "value": "Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.\n\nThe SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.\n\nAn authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.\n\nThe vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssh from 3.0.1 before 5.2.11.9, 5.5.2.2, and 6.0.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown." } ], "impacts": [ @@ -210,21 +262,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 2.3, "baseSeverity": "LOW", "privilegesRequired": "LOW", + "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", - "vulnIntegrityImpact": "NONE" + "vulnIntegrityImpact": "NONE", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -250,10 +308,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-24T14:16:07.357Z" + "dateUpdated": "2026-11-11T18:58:19.012Z" }, "references": [ { + "name": "OTP ssh_sftpd REALPATH Path Existence Oracle ( File system Enumeration )", "tags": [ "vendor-advisory", "related" @@ -261,40 +320,46 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976" }, { + "name": "EEF CNA record for CVE-2026-53422", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-53422.html" }, { + "name": "OSV record EEF-CVE-2026-53422", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53422" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { - "tags": [ - "patch" - ], - "url": "https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172" - }, - { + "name": "Fix commit 86622cf in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94" }, { + "name": "Fix commit c5a8f50 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a" + }, + { + "name": "Fix commit 059e578 in erlang/otp", + "tags": [ + "patch" + ], + "url": "https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172" } ], "source": { @@ -308,15 +373,17 @@ { "base64": false, "type": "text/html", - "value": "root option.The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.
The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit.
The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact.
Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications.
No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth.
This vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4.
This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.
" + "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.
The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.
The SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit.
The targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact.
Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications.
No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth.
\nThis vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssh from 3.0.1 before 5.2.11.9, 5.5.2.2, and 6.0.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP `ssh` (`ssh_sftpd` module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.\n\nThe `handle_data/4` function in `ssh_sftpd` contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (`SSH_MSG_CHANNEL_EXTENDED_DATA`) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.\n\nThe SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending `SSH_MSG_CHANNEL_EXTENDED_DATA` with any `data_type_code` and any non-empty payload at or below the size limit.\n\nThe targeted `ssh_sftpd` process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact.\n\nErlang/OTP SSH configurations using the default `max_channels` setting (`infinity`) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications.\n\nNo file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth.\n\nThis vulnerability is associated with program file `lib/ssh/src/ssh_sftpd.erl` and program routine `ssh_sftpd:handle_data/4`.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssh from 3.0.1 before 5.2.11.9, 5.5.2.2, and 6.0.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown." } ], - "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.\n\nThe handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.\n\nThe SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit.\n\nThe targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact.\n\nErlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications.\n\nNo file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth.\n\nThis vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9." + "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.\n\nThe handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.\n\nThe SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel, so an authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the size limit.\n\nThe targeted ssh_sftpd process enters an infinite tail-recursive loop. It never processes another message, its message queue grows without bound, and it can only be stopped by killing the process. BEAM's reduction-based scheduler preemption continues to function, so other processes on the node are not starved, but each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact.\n\nErlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications.\n\nNo file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth.\n\nThis vulnerability is associated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_data/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssh from 3.0.1 before 5.2.11.9, 5.5.2.2, and 6.0.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown." } ], "impacts": [ @@ -183,11 +218,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "attackComplexity": "LOW", + "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", + "privilegesRequired": "LOW", + "providerUrgency": "NOT_DEFINED", + "subAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", - "version": "4.0" + "version": "4.0", + "vulnAvailabilityImpact": "LOW", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -203,10 +254,14 @@ "descriptions": [ { "cweId": "CWE-835", - "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')", + "description": "CWE-835 Loop with Unreachable Exit Condition", "lang": "en", "type": "CWE" - }, + } + ] + }, + { + "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", @@ -219,10 +274,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-24T14:14:32.812Z" + "dateUpdated": "2026-11-11T18:55:39.707Z" }, "references": [ { + "name": "SSH SFTP server denial of service via extended data infinite loop", "tags": [ "vendor-advisory", "related" @@ -230,24 +286,28 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9" }, { + "name": "EEF CNA record for CVE-2026-54886", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-54886.html" }, { + "name": "OSV record EEF-CVE-2026-54886", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-54886" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Fix commit eaf9550 in erlang/otp", "tags": [ "patch" ], @@ -265,15 +325,17 @@ { "base64": false, "type": "text/html", - "value": "max_channels daemon option to a finite value (e.g., {max_channels, 10}) to limit the number of channels an attacker can open per connection.max_sessions daemon option to limit total concurrent SSH connections to the daemon.ssh_sftpd processes with abnormally high reduction counts and growing message queues.Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.
On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext ClientHello can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.
This vulnerability is associated with program file lib/ssl/src/dtls_server_connection.erl and program routine dtls_server_connection:initial_hello/3.
This issue affects OTP from OTP 20.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssl from 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10.
" + "value": "Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.
\nOn DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext ClientHello can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.
This vulnerability is associated with program file lib/ssl/src/dtls_server_connection.erl and program routine dtls_server_connection:initial_hello/3.
This issue affects OTP from OTP 20.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssl from 8.2 before 11.2.12.10, 11.6.0.3, and 11.7.3.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.\n\nOn DTLS server startup, `dtls_server_connection:initial_hello/3` initializes `previous_cookie_secret` to the empty binary (`<<>>`) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext `ClientHello` can compute `dtls_handshake:cookie(<<>>, IP, Port, Hello)` and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext `ClientHello` can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.\n\nThis vulnerability is associated with program file `lib/ssl/src/dtls_server_connection.erl` and program routine `dtls_server_connection:initial_hello/3`.\n\nThis issue affects OTP from OTP 20.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssl from 8.2 before 11.2.12.10, 11.6.0.3, and 11.7.3." } ], - "value": "Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.\n\nOn DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext ClientHello can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.\n\nThis vulnerability is associated with program file lib/ssl/src/dtls_server_connection.erl and program routine dtls_server_connection:initial_hello/3.\n\nThis issue affects OTP from OTP 20.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssl from 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10." + "value": "Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.\n\nOn DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext ClientHello can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.\n\nThis vulnerability is associated with program file lib/ssl/src/dtls_server_connection.erl and program routine dtls_server_connection:initial_hello/3.\n\nThis issue affects OTP from OTP 20.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssl from 8.2 before 11.2.12.10, 11.6.0.3, and 11.7.3." } ], "impacts": [ @@ -184,21 +213,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", + "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", - "vulnIntegrityImpact": "NONE" + "vulnIntegrityImpact": "NONE", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -224,10 +259,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-24T14:15:16.337Z" + "dateUpdated": "2026-11-11T18:50:00.580Z" }, "references": [ { + "name": "DTLS Cookie Bypass During Startup", "tags": [ "vendor-advisory", "related" @@ -235,24 +271,35 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-p2m2-3c2w-8jp8" }, { + "name": "EEF CNA record for CVE-2026-54887", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-54887.html" }, { + "name": "OSV record EEF-CVE-2026-54887", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-54887" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit e594aad in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/e594aad2f87aab39e99fccf9e021bc94e0bbf7d4" + }, + { + "name": "Fix commit 888e3bc in erlang/otp", "tags": [ "patch" ], @@ -262,10 +309,7 @@ "source": { "discovery": "INTERNAL" }, - "title": "DTLS server cookie bypass during startup window due to empty initial cookie secret", - "x_generator": { - "engine": "cvelib 1.8.0" - } + "title": "DTLS server cookie bypass during startup window due to empty initial cookie secret" }, "adp": [ { diff --git a/data/2026/54xxx/CVE-2026-54890.json b/data/2026/54xxx/CVE-2026-54890.json index 025fc25062..68567a54a6 100644 --- a/data/2026/54xxx/CVE-2026-54890.json +++ b/data/2026/54xxx/CVE-2026-54890.json @@ -8,11 +8,57 @@ "assignerShortName": "EEF", "dateReserved": "2026-06-16T10:47:13.915Z", "datePublished": "2026-07-27T15:39:03.475Z", - "dateUpdated": "2026-07-28T09:55:08.138Z" + "dateUpdated": "2026-11-11T18:47:44.385Z" }, "containers": { "cna": { "affected": [ + { + "cpes": [ + "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "modules": [ + "erts" + ], + "packageName": "otp", + "packageURL": "pkg:software-id/erlang.org/otp", + "product": "OTP", + "programFiles": [ + "erts/emulator/beam/external.c" + ], + "programRoutines": [ + { + "name": "erlang:binary_to_term/1" + }, + { + "name": "erlang:binary_to_term/2" + } + ], + "vendor": "Erlang", + "versions": [ + { + "changes": [ + { + "at": "27.3.4.15", + "status": "unaffected" + }, + { + "at": "28.5.0.4", + "status": "unaffected" + }, + { + "at": "29.0.4", + "status": "unaffected" + } + ], + "lessThan": "*", + "status": "affected", + "version": "27.0", + "versionType": "otp" + } + ] + }, { "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" @@ -22,7 +68,7 @@ "erts" ], "packageName": "erts", - "packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", + "packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "emulator/beam/external.c" @@ -86,26 +132,6 @@ "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ - { - "changes": [ - { - "at": "27.3.4.15", - "status": "unaffected" - }, - { - "at": "28.5.0.4", - "status": "unaffected" - }, - { - "at": "29.0.4", - "status": "unaffected" - } - ], - "lessThan": "*", - "status": "affected", - "version": "27.0", - "versionType": "otp" - }, { "lessThan": "dc1bf9344c0ce62717cf60866590cea0242780fd", "status": "affected", @@ -163,6 +189,7 @@ "value": "John Högberg" } ], + "datePublic": "2026-07-27T15:39:03.000Z", "descriptions": [ { "lang": "en", @@ -170,10 +197,15 @@ { "base64": false, "type": "text/html", - "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\").
The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).
Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).
This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
" + "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.
The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\").
The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).
Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).
This issue affects OTP from OTP 27.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files `erts/emulator/beam/external.c`, `emulator/beam/external.c`.\n\nThe `BIT_BINARY_EXT` tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as `Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\")`.\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by `try`/`catch`, or by passing the `[safe]` option to `binary_to_term/2` (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via `binary_to_term/1,2` or `enif_binary_to_term()` is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4." } ], - "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11." + "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\").\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4." } ], "impacts": [ @@ -199,21 +231,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", + "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", - "vulnIntegrityImpact": "NONE" + "vulnIntegrityImpact": "NONE", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -232,13 +270,21 @@ "description": "CWE-191 Integer Underflow (Wrap or Wraparound)", "lang": "en", "type": "CWE" - }, + } + ] + }, + { + "descriptions": [ { "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "type": "CWE" - }, + } + ] + }, + { + "descriptions": [ { "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", @@ -251,10 +297,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-28T09:55:08.138Z" + "dateUpdated": "2026-11-11T18:47:44.385Z" }, "references": [ { + "name": "binary_to_term crash on crafted BIT_BINARY_EXT input", "tags": [ "vendor-advisory", "related" @@ -262,24 +309,35 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86" }, { + "name": "EEF CNA record for CVE-2026-54890", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-54890.html" }, { + "name": "OSV record EEF-CVE-2026-54890", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-54890" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit 24ef4cb in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/24ef4cbaeda9b9c26682cba75f2f15b0c58722aa" + }, + { + "name": "Fix commit dc1bf93 in erlang/otp", "tags": [ "patch" ], @@ -297,15 +355,17 @@ { "base64": false, "type": "text/html", - "value": "Do not call binary_to_term/1,2 or enif_binary_to_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.
" + "value": "Do not call binary_to_term/1,2 or enif_binary_to_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.
Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine.
When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.
This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
" + "value": "Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine.
When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.
This issue affects OTP from OTP 25.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 13.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.
" + }, + { + "base64": false, + "type": "text/markdown", + "value": "Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP `erts` allows an attacker who can supply a crafted Erlang external term format (ETF) binary to `binary_to_term/1` to corrupt the BEAM heap pointer and crash the virtual machine.\n\nWhen decoding a `LARGE_TUPLE_EXT` term, the validation pass `decoded_size()` in `erts/emulator/beam/external.c` reads the 32-bit arity field as unsigned (`get_uint32()`), while the decode pass `dec_term()` reads the same field as a signed 32-bit integer (`get_int32()`) into an `int`. An arity wire value of `0x80000000` passes validation as 2147483648 but decodes as -2147483648, so the subsequent `hp += n` moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit `MAX_ARITYVAL`. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.\n\nThis issue affects OTP from OTP 25.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 13.0 before 15.2.7.11, 16.4.0.4, and 17.0.4." } ], - "value": "Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine.\n\nWhen decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.\n\nThis issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11." + "value": "Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine.\n\nWhen decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.\n\nThis issue affects OTP from OTP 25.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 13.0 before 15.2.7.11, 16.4.0.4, and 17.0.4." } ], "impacts": [ @@ -204,21 +243,27 @@ "metrics": [ { "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", + "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", - "vulnIntegrityImpact": "NONE" + "vulnIntegrityImpact": "NONE", + "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ @@ -237,7 +282,11 @@ "description": "CWE-195 Signed to Unsigned Conversion Error", "lang": "en", "type": "CWE" - }, + } + ] + }, + { + "descriptions": [ { "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", @@ -250,10 +299,11 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-07-28T09:55:26.434Z" + "dateUpdated": "2026-11-11T18:45:35.184Z" }, "references": [ { + "name": "Heap Pointer Corruption via signed/unsigned Mismatch in LARGE_TUPLE_EXT Decoding (binary_to_term/1)", "tags": [ "vendor-advisory", "related" @@ -261,24 +311,35 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-446w-268v-9462" }, { + "name": "EEF CNA record for CVE-2026-55737", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-55737.html" }, { + "name": "OSV record EEF-CVE-2026-55737", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55737" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit ebcbb97 in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/ebcbb97b4ec223464cac3d94375739a248ddef6e" + }, + { + "name": "Fix commit c5210b4 in erlang/otp", "tags": [ "patch" ], @@ -288,10 +349,7 @@ "source": { "discovery": "EXTERNAL" }, - "title": "Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder", - "x_generator": { - "engine": "cvelib 1.8.0" - } + "title": "Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder" }, "adp": [ { diff --git a/data/2026/59xxx/CVE-2026-59251.json b/data/2026/59xxx/CVE-2026-59251.json index 07ed7ec41a..6a6f9332e4 100644 --- a/data/2026/59xxx/CVE-2026-59251.json +++ b/data/2026/59xxx/CVE-2026-59251.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-07-04T04:24:03.653Z", "datePublished": "2026-07-27T15:30:47.097Z", - "dateUpdated": "2026-11-11T14:22:44.647Z" + "dateUpdated": "2026-11-11T18:52:31.905Z" }, "containers": { "cna": { @@ -199,6 +199,7 @@ "value": "Michał Wąsowski" } ], + "datePublic": "2026-07-27T15:30:47.000Z", "descriptions": [ { "lang": "en", @@ -277,7 +278,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-11-11T14:22:44.647Z" + "dateUpdated": "2026-11-11T18:52:31.905Z" }, "references": [ { diff --git a/data/2026/61xxx/CVE-2026-61637.json b/data/2026/61xxx/CVE-2026-61637.json new file mode 100644 index 0000000000..ea9a6451d3 --- /dev/null +++ b/data/2026/61xxx/CVE-2026-61637.json @@ -0,0 +1,88 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-61637", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-10T17:38:57.111Z", + "datePublished": "2026-11-11T18:26:59.587Z", + "dateUpdated": "2026-11-11T18:26:59.587Z" + }, + "containers": { + "cna": { + "title": "Icinga Web 2: Open redirect on login page, under certain circumstances", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-601", + "lang": "en", + "description": "CWE-601: URL Redirection to Untrusted Site", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 3.5, + "baseSeverity": "LOW", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv" + } + ], + "affected": [ + { + "vendor": "Icinga", + "product": "icingaweb2", + "versions": [ + { + "version": "< 2.12.7", + "status": "affected" + }, + { + "version": "< 2.13.1", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T18:26:59.587Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1." + } + ], + "source": { + "advisory": "GHSA-w7c2-xjv9-q8fv", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/65xxx/CVE-2026-65833.json b/data/2026/65xxx/CVE-2026-65833.json new file mode 100644 index 0000000000..9a24d8a7bd --- /dev/null +++ b/data/2026/65xxx/CVE-2026-65833.json @@ -0,0 +1,94 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-65833", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-22T23:16:47.753Z", + "datePublished": "2026-11-11T18:23:41.315Z", + "dateUpdated": "2026-11-11T18:23:41.315Z" + }, + "containers": { + "cna": { + "title": "iopress: buffer over-read in chunked HTTP parser", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-126", + "lang": "en", + "description": "CWE-126: Buffer Over-read", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 6.9, + "baseSeverity": "MEDIUM", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/senapati484/iopress/security/advisories/GHSA-pvr5-58cf-rgv6", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/senapati484/iopress/security/advisories/GHSA-pvr5-58cf-rgv6" + }, + { + "name": "https://github.com/senapati484/iopress/releases/tag/v1.0.5", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/senapati484/iopress/releases/tag/v1.0.5" + } + ], + "affected": [ + { + "vendor": "senapati484", + "product": "iopress", + "versions": [ + { + "version": "< 1.0.5", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T18:23:41.315Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5." + } + ], + "source": { + "advisory": "GHSA-pvr5-58cf-rgv6", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/65xxx/CVE-2026-65840.json b/data/2026/65xxx/CVE-2026-65840.json new file mode 100644 index 0000000000..229a3219fb --- /dev/null +++ b/data/2026/65xxx/CVE-2026-65840.json @@ -0,0 +1,91 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-65840", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-22T23:16:47.753Z", + "datePublished": "2026-11-11T18:32:50.465Z", + "dateUpdated": "2026-11-11T18:32:50.465Z" + }, + "containers": { + "cna": { + "title": "Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-639", + "lang": "en", + "description": "CWE-639: Authorization Bypass Through User-Controlled Key", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 9.6, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58" + }, + { + "name": "https://github.com/getfider/fider/releases/tag/v0.36.0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/getfider/fider/releases/tag/v0.36.0" + } + ], + "affected": [ + { + "vendor": "getfider", + "product": "fider", + "versions": [ + { + "version": "< 0.36.0", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T18:32:50.465Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0." + } + ], + "source": { + "advisory": "GHSA-vxjw-gv4f-vq58", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/65xxx/CVE-2026-65843.json b/data/2026/65xxx/CVE-2026-65843.json new file mode 100644 index 0000000000..93c3af8115 --- /dev/null +++ b/data/2026/65xxx/CVE-2026-65843.json @@ -0,0 +1,94 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-65843", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-22T23:16:47.753Z", + "datePublished": "2026-11-11T18:29:55.356Z", + "dateUpdated": "2026-11-11T18:29:55.356Z" + }, + "containers": { + "cna": { + "title": "sync-rpc: Arbitrary remote code execution vulnerability", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-306", + "lang": "en", + "description": "CWE-306: Missing Authentication for Critical Functionality", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/ForbesLindesay/sync-rpc/security/advisories/GHSA-2x86-cf3f-86gw", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/ForbesLindesay/sync-rpc/security/advisories/GHSA-2x86-cf3f-86gw" + }, + { + "name": "https://github.com/ForbesLindesay/sync-rpc/commit/ffccfe5bc39ad2e291a79c9e5afe6155ad311f07", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/ForbesLindesay/sync-rpc/commit/ffccfe5bc39ad2e291a79c9e5afe6155ad311f07" + } + ], + "affected": [ + { + "vendor": "ForbesLindesay", + "product": "sync-rpc", + "versions": [ + { + "version": "< 1.3.7", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T18:29:55.356Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7." + } + ], + "source": { + "advisory": "GHSA-2x86-cf3f-86gw", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/65xxx/CVE-2026-65967.json b/data/2026/65xxx/CVE-2026-65967.json new file mode 100644 index 0000000000..18d383054e --- /dev/null +++ b/data/2026/65xxx/CVE-2026-65967.json @@ -0,0 +1,91 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-65967", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-23T18:15:14.579Z", + "datePublished": "2026-11-11T18:33:09.909Z", + "dateUpdated": "2026-11-11T18:33:09.909Z" + }, + "containers": { + "cna": { + "title": "Fider: Server-Side Request Forgery (SSRF) via Webhook URL", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-918", + "lang": "en", + "description": "CWE-918: Server-Side Request Forgery", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r" + }, + { + "name": "https://github.com/getfider/fider/releases/tag/v0.34.0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/getfider/fider/releases/tag/v0.34.0" + } + ], + "affected": [ + { + "vendor": "getfider", + "product": "fider", + "versions": [ + { + "version": "< 0.34.0", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T18:33:09.909Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0." + } + ], + "source": { + "advisory": "GHSA-g445-xwm7-594r", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/71xxx/CVE-2026-71395.json b/data/2026/71xxx/CVE-2026-71395.json index f853d588cb..fcbcd02434 100644 --- a/data/2026/71xxx/CVE-2026-71395.json +++ b/data/2026/71xxx/CVE-2026-71395.json @@ -8,7 +8,7 @@ "assignerShortName": "apache", "dateReserved": "2026-08-06T09:27:16.734Z", "datePublished": "2026-11-11T14:53:54.218Z", - "dateUpdated": "2026-11-11T14:53:54.218Z" + "dateUpdated": "2026-11-11T19:05:32.557Z" }, "containers": { "cna": { @@ -100,6 +100,21 @@ "x_generator": { "engine": "Vulnogram 0.2.0" } - } + }, + "adp": [ + { + "title": "CVE Program Container", + "references": [ + { + "url": "http://www.openwall.com/lists/oss-security/2026/11/11/19" + } + ], + "providerMetadata": { + "orgId": "af854a3a-2127-422b-91ae-364da2661108", + "shortName": "CVE", + "dateUpdated": "2026-11-11T19:05:32.557Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/76xxx/CVE-2026-76235.json b/data/2026/76xxx/CVE-2026-76235.json index b7141e6bc8..ab1c0fc258 100644 --- a/data/2026/76xxx/CVE-2026-76235.json +++ b/data/2026/76xxx/CVE-2026-76235.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-08-19T11:37:44.676Z", "datePublished": "2026-08-19T12:44:55.680Z", - "dateUpdated": "2026-11-11T13:11:49.966Z" + "dateUpdated": "2026-11-11T19:09:04.604Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:366.1-1.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -234,6 +252,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98567", + "name": "RHSA-2026:98567", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-76235", "tags": [ @@ -291,7 +317,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T13:11:49.966Z" + "dateUpdated": "2026-11-11T19:09:04.604Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/84xxx/CVE-2026-84268.json b/data/2026/84xxx/CVE-2026-84268.json index 7385c81771..958616da0b 100644 --- a/data/2026/84xxx/CVE-2026-84268.json +++ b/data/2026/84xxx/CVE-2026-84268.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-01T14:05:54.144Z", "datePublished": "2026-09-01T15:15:23.685Z", - "dateUpdated": "2026-11-11T13:55:56.972Z" + "dateUpdated": "2026-11-11T18:26:14.101Z" }, "containers": { "cna": { @@ -287,6 +287,25 @@ "cpe:/a:redhat:enterprise_linux:9::crb" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gvfs", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.48.1-9.el9_9.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:enterprise_linux:9::appstream", + "cpe:/a:redhat:enterprise_linux:9::crb" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", @@ -442,6 +461,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98513", + "name": "RHSA-2026:98513", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:98623", "name": "RHSA-2026:98623", @@ -510,7 +537,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T13:55:56.972Z" + "dateUpdated": "2026-11-11T18:26:14.101Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/84xxx/CVE-2026-84725.json b/data/2026/84xxx/CVE-2026-84725.json index b120995c0c..81a224ea85 100644 --- a/data/2026/84xxx/CVE-2026-84725.json +++ b/data/2026/84xxx/CVE-2026-84725.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-02T04:14:23.387Z", "datePublished": "2026-10-28T17:30:13.626Z", - "dateUpdated": "2026-11-10T21:45:37.076Z" + "dateUpdated": "2026-11-11T18:37:36.813Z" }, "containers": { "cna": { @@ -48,6 +48,664 @@ } ], "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "defaultStatus": "unaffected", + "packageName": "openjdk-orb", + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform:7.4" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-apache-cxf", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:3.5.11-2.SP2_redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-annotations", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-core", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-databind", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-jaxrs-providers", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-modules-base", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-modules-java8", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jboss-server-migration", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.10.0-47.Final_redhat_00045.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jbossws-cxf", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:5.4.18-1.Final_redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-undertow", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.2.40-3.SP4_redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-wildfly", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:7.4.26-5.GA_redhat_00002.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-wildfly-elytron", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.15.30-1.Final_redhat_00001.1.el7eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-apache-cxf", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:3.5.11-2.SP2_redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-annotations", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-core", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-databind", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-jaxrs-providers", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-modules-base", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-modules-java8", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jboss-server-migration", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.10.0-47.Final_redhat_00045.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jbossws-cxf", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:5.4.18-1.Final_redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-undertow", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.2.40-3.SP4_redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-wildfly", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:7.4.26-5.GA_redhat_00002.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-wildfly-elytron", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.15.30-1.Final_redhat_00001.1.el8eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-apache-cxf", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:3.5.11-2.SP2_redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-annotations", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-core", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-databind", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-jaxrs-providers", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-modules-base", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jackson-modules-java8", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.18.10-1.redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jboss-server-migration", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.10.0-47.Final_redhat_00045.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-jbossws-cxf", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:5.4.18-1.Final_redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-undertow", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.2.40-3.SP4_redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-wildfly", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:7.4.26-5.GA_redhat_00002.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "eap7-wildfly-elytron", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.15.30-1.Final_redhat_00001.1.el9eap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9" + ] + }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1", @@ -57,16 +715,6 @@ "cpes": [ "cpe:/a:redhat:jboss_enterprise_application_platform:8.1" ] - }, - { - "vendor": "Red Hat", - "product": "Red Hat JBoss Enterprise Application Platform 7", - "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", - "packageName": "openjdk-orb", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:jboss_enterprise_application_platform:7" - ] } ], "references": [ @@ -78,6 +726,38 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99096", + "name": "RHSA-2026:99096", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99097", + "name": "RHSA-2026:99097", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99098", + "name": "RHSA-2026:99098", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99099", + "name": "RHSA-2026:99099", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-84725", "tags": [ @@ -129,7 +809,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-10T21:45:37.076Z" + "dateUpdated": "2026-11-11T18:37:36.813Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/85xxx/CVE-2026-85013.json b/data/2026/85xxx/CVE-2026-85013.json index 4e17fe8039..01deef11e1 100644 --- a/data/2026/85xxx/CVE-2026-85013.json +++ b/data/2026/85xxx/CVE-2026-85013.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-02T19:15:03.876Z", "datePublished": "2026-09-15T15:08:33.907Z", - "dateUpdated": "2026-11-11T11:44:40.930Z" + "dateUpdated": "2026-11-11T19:08:54.330Z" }, "containers": { "cna": { @@ -120,6 +120,24 @@ "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "environment-modules", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:5.3.0-3.el9_9", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:9::baseos" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Hardened Images", @@ -202,6 +220,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98460", + "name": "RHSA-2026:98460", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:98565", "name": "RHSA-2026:98565", @@ -270,7 +296,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T11:44:40.930Z" + "dateUpdated": "2026-11-11T19:08:54.330Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86476.json b/data/2026/86xxx/CVE-2026-86476.json index e5c082e421..33e6012b12 100644 --- a/data/2026/86xxx/CVE-2026-86476.json +++ b/data/2026/86xxx/CVE-2026-86476.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-07T15:33:12.901Z", "datePublished": "2026-10-14T10:00:02.763Z", - "dateUpdated": "2026-11-11T11:35:10.844Z" + "dateUpdated": "2026-11-11T18:35:47.670Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.3" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10.2 Extended Update Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gstreamer1-plugins-base", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.26.7-2.el10_2.3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux_eus:10.2" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", @@ -126,6 +144,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99033", + "name": "RHSA-2026:99033", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86476", "tags": [ @@ -186,7 +212,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T11:35:10.844Z" + "dateUpdated": "2026-11-11T18:35:47.670Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/88xxx/CVE-2026-88924.json b/data/2026/88xxx/CVE-2026-88924.json index 5ad8513501..51eb28afa1 100644 --- a/data/2026/88xxx/CVE-2026-88924.json +++ b/data/2026/88xxx/CVE-2026-88924.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-10T14:04:13.603Z", "datePublished": "2026-09-10T14:32:30.644Z", - "dateUpdated": "2026-11-11T13:56:00.052Z" + "dateUpdated": "2026-11-11T18:26:19.179Z" }, "containers": { "cna": { @@ -148,6 +148,25 @@ "cpe:/a:redhat:enterprise_linux:9::crb" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gvfs", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.48.1-9.el9_9.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:enterprise_linux:9::appstream", + "cpe:/a:redhat:enterprise_linux:9::crb" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", @@ -283,6 +302,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98513", + "name": "RHSA-2026:98513", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:98623", "name": "RHSA-2026:98623", @@ -351,7 +378,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T13:56:00.052Z" + "dateUpdated": "2026-11-11T18:26:19.179Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/89xxx/CVE-2026-89326.json b/data/2026/89xxx/CVE-2026-89326.json index 3fb23cb07a..62231d85cb 100644 --- a/data/2026/89xxx/CVE-2026-89326.json +++ b/data/2026/89xxx/CVE-2026-89326.json @@ -8,7 +8,7 @@ "assignerShortName": "apache", "dateReserved": "2026-09-11T14:36:27.416Z", "datePublished": "2026-11-11T14:57:44.444Z", - "dateUpdated": "2026-11-11T14:57:44.444Z" + "dateUpdated": "2026-11-11T19:05:33.889Z" }, "containers": { "cna": { @@ -100,6 +100,21 @@ "x_generator": { "engine": "Vulnogram 1.0.3" } - } + }, + "adp": [ + { + "title": "CVE Program Container", + "references": [ + { + "url": "http://www.openwall.com/lists/oss-security/2026/11/11/21" + } + ], + "providerMetadata": { + "orgId": "af854a3a-2127-422b-91ae-364da2661108", + "shortName": "CVE", + "dateUpdated": "2026-11-11T19:05:33.889Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/90xxx/CVE-2026-90993.json b/data/2026/90xxx/CVE-2026-90993.json index 0e629f692b..0f1962058d 100644 --- a/data/2026/90xxx/CVE-2026-90993.json +++ b/data/2026/90xxx/CVE-2026-90993.json @@ -8,7 +8,7 @@ "assignerShortName": "apache", "dateReserved": "2026-09-14T14:32:55.692Z", "datePublished": "2026-11-11T10:20:13.294Z", - "dateUpdated": "2026-11-11T10:20:13.294Z" + "dateUpdated": "2026-11-11T19:05:35.223Z" }, "containers": { "cna": { @@ -100,6 +100,21 @@ "x_generator": { "engine": "Vulnogram 1.0.3" } - } + }, + "adp": [ + { + "title": "CVE Program Container", + "references": [ + { + "url": "http://www.openwall.com/lists/oss-security/2026/11/11/20" + } + ], + "providerMetadata": { + "orgId": "af854a3a-2127-422b-91ae-364da2661108", + "shortName": "CVE", + "dateUpdated": "2026-11-11T19:05:35.223Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/91xxx/CVE-2026-91147.json b/data/2026/91xxx/CVE-2026-91147.json index c3a85a7341..1f80fa8346 100644 --- a/data/2026/91xxx/CVE-2026-91147.json +++ b/data/2026/91xxx/CVE-2026-91147.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-14T20:35:52.198Z", "datePublished": "2026-09-18T16:43:51.546Z", - "dateUpdated": "2026-11-11T13:11:50.942Z" + "dateUpdated": "2026-11-11T19:09:05.520Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:366.1-1.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -234,6 +252,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98567", + "name": "RHSA-2026:98567", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-91147", "tags": [ @@ -291,7 +317,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T13:11:50.942Z" + "dateUpdated": "2026-11-11T19:09:05.520Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/91xxx/CVE-2026-91150.json b/data/2026/91xxx/CVE-2026-91150.json new file mode 100644 index 0000000000..7c191860af --- /dev/null +++ b/data/2026/91xxx/CVE-2026-91150.json @@ -0,0 +1,187 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-91150", + "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", + "state": "PUBLISHED", + "assignerShortName": "redhat", + "dateReserved": "2026-09-14T20:36:53.441Z", + "datePublished": "2026-11-11T18:38:12.565Z", + "dateUpdated": "2026-11-11T18:38:12.565Z" + }, + "containers": { + "cna": { + "title": "Cockpit: cockpit: denial of service via unbounded fragmented websocket messages", + "metrics": [ + { + "other": { + "content": { + "value": "Important", + "namespace": "https://access.redhat.com/security/updates/classification/" + }, + "type": "Red Hat severity rating" + } + }, + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" + }, + "format": "CVSS" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service." + } + ], + "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:enterprise_linux:10" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit", + "defaultStatus": "affected", + "cpes": [ + "cpe:/o:redhat:rhel_els:7" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 8", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:enterprise_linux:8" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:enterprise_linux:9" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat OpenShift Dev Spaces", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "devspaces/udi-base-rhel10", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:openshift_devspaces:3" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat OpenShift Dev Spaces", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "devspaces/udi-base-rhel9", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:openshift_devspaces:3" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat OpenShift Dev Spaces", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "devspaces/udi-rhel9", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:openshift_devspaces:3" + ] + } + ], + "references": [ + { + "url": "https://access.redhat.com/security/cve/CVE-2026-91150", + "tags": [ + "vdb-entry", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478436", + "name": "RHBZ#2478436", + "tags": [ + "issue-tracking", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93" + }, + { + "url": "https://github.com/cockpit-project/cockpit/releases/tag/372" + } + ], + "datePublic": "2026-11-10T23:59:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-770", + "description": "Allocation of Resources Without Limits or Throttling", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling", + "timeline": [ + { + "lang": "en", + "time": "2026-05-18T03:32:25.000Z", + "value": "Reported to Red Hat." + }, + { + "lang": "en", + "time": "2026-11-10T23:59:00.000Z", + "value": "Made public." + } + ], + "credits": [ + { + "lang": "en", + "value": "This issue was discovered by AISLE Research and Found by AISLE in partnership with Red Hat." + } + ], + "providerMetadata": { + "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", + "shortName": "redhat", + "dateUpdated": "2026-11-11T18:38:12.565Z" + }, + "x_generator": { + "engine": "cvelib 1.8.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/91xxx/CVE-2026-91873.json b/data/2026/91xxx/CVE-2026-91873.json new file mode 100644 index 0000000000..eabdf1f0b5 --- /dev/null +++ b/data/2026/91xxx/CVE-2026-91873.json @@ -0,0 +1,102 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-91873", + "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "state": "PUBLISHED", + "assignerShortName": "dell", + "dateReserved": "2026-09-15T10:04:43.433Z", + "datePublished": "2026-11-11T18:33:07.957Z", + "dateUpdated": "2026-11-11T18:33:07.957Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "shortName": "dell", + "dateUpdated": "2026-11-11T18:33:07.957Z" + }, + "datePublic": "2026-09-29T18:30:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-295", + "description": "CWE-295: Improper Certificate Validation", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Dell", + "product": "OpenManage Ansible Modules", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "11.0.0 or later", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access." + } + ] + } + ], + "references": [ + { + "url": "https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "CHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE", + "baseSeverity": "HIGH", + "baseScore": 8.7, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/91xxx/CVE-2026-91876.json b/data/2026/91xxx/CVE-2026-91876.json new file mode 100644 index 0000000000..1ba0361454 --- /dev/null +++ b/data/2026/91xxx/CVE-2026-91876.json @@ -0,0 +1,102 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-91876", + "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "state": "PUBLISHED", + "assignerShortName": "dell", + "dateReserved": "2026-09-15T10:04:43.433Z", + "datePublished": "2026-11-11T18:22:41.165Z", + "dateUpdated": "2026-11-11T18:22:41.165Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "shortName": "dell", + "dateUpdated": "2026-11-11T18:22:41.165Z" + }, + "datePublic": "2026-09-30T06:30:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-611", + "description": "CWE-611: Improper Restriction of XML External Entity Reference", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Dell", + "product": "OpenManage Ansible Modules", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "11.0.0 or later", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure." + } + ] + } + ], + "references": [ + { + "url": "https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseSeverity": "MEDIUM", + "baseScore": 5.5, + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/91xxx/CVE-2026-91877.json b/data/2026/91xxx/CVE-2026-91877.json new file mode 100644 index 0000000000..6bd1a880b0 --- /dev/null +++ b/data/2026/91xxx/CVE-2026-91877.json @@ -0,0 +1,102 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-91877", + "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "state": "PUBLISHED", + "assignerShortName": "dell", + "dateReserved": "2026-09-15T10:04:43.433Z", + "datePublished": "2026-11-11T18:26:11.121Z", + "dateUpdated": "2026-11-11T18:26:11.121Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "shortName": "dell", + "dateUpdated": "2026-11-11T18:26:11.121Z" + }, + "datePublic": "2026-09-30T06:30:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-943", + "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Dell", + "product": "OpenManage Ansible Modules", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "11.0.0 or later", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized data access, authorization bypass, and denial of service.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized data access, authorization bypass, and denial of service." + } + ] + } + ], + "references": [ + { + "url": "https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseSeverity": "HIGH", + "baseScore": 7.6, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/91xxx/CVE-2026-91878.json b/data/2026/91xxx/CVE-2026-91878.json new file mode 100644 index 0000000000..037a50dd59 --- /dev/null +++ b/data/2026/91xxx/CVE-2026-91878.json @@ -0,0 +1,102 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-91878", + "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "state": "PUBLISHED", + "assignerShortName": "dell", + "dateReserved": "2026-09-15T10:04:43.433Z", + "datePublished": "2026-11-11T18:29:41.098Z", + "dateUpdated": "2026-11-11T18:29:41.098Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "shortName": "dell", + "dateUpdated": "2026-11-11T18:29:41.098Z" + }, + "datePublic": "2026-09-30T06:30:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-91", + "description": "CWE-91: XML Injection (aka Blind XPath Injection)", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Dell", + "product": "OpenManage Ansible Modules", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "11.0.0 or later", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors" + } + ] + } + ], + "references": [ + { + "url": "https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "availabilityImpact": "LOW", + "baseSeverity": "HIGH", + "baseScore": 7.6, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/92xxx/CVE-2026-92745.json b/data/2026/92xxx/CVE-2026-92745.json index fce610ef21..f35078e2c3 100644 --- a/data/2026/92xxx/CVE-2026-92745.json +++ b/data/2026/92xxx/CVE-2026-92745.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-16T18:40:00.345Z", "datePublished": "2026-09-18T17:53:29.077Z", - "dateUpdated": "2026-11-11T11:49:48.210Z" + "dateUpdated": "2026-11-11T19:08:48.083Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit-machines", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:355.1-1.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", @@ -128,6 +146,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98562", + "name": "RHSA-2026:98562", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-92745", "tags": [ @@ -185,7 +211,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T11:49:48.210Z" + "dateUpdated": "2026-11-11T19:08:48.083Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/92xxx/CVE-2026-92747.json b/data/2026/92xxx/CVE-2026-92747.json index fd9f98327d..18cdb5b9b2 100644 --- a/data/2026/92xxx/CVE-2026-92747.json +++ b/data/2026/92xxx/CVE-2026-92747.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-16T18:50:18.131Z", "datePublished": "2026-09-18T17:53:35.109Z", - "dateUpdated": "2026-11-11T11:49:48.526Z" + "dateUpdated": "2026-11-11T19:08:49.016Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit-machines", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:355.1-1.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", @@ -128,6 +146,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98562", + "name": "RHSA-2026:98562", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-92747", "tags": [ @@ -185,7 +211,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T11:49:48.526Z" + "dateUpdated": "2026-11-11T19:08:49.016Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/92xxx/CVE-2026-92768.json b/data/2026/92xxx/CVE-2026-92768.json index e0f238c0d9..c0e3ad9286 100644 --- a/data/2026/92xxx/CVE-2026-92768.json +++ b/data/2026/92xxx/CVE-2026-92768.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-16T19:08:56.383Z", "datePublished": "2026-09-18T17:53:54.833Z", - "dateUpdated": "2026-11-11T11:49:47.386Z" + "dateUpdated": "2026-11-11T19:08:48.999Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit-machines", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:355.1-1.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", @@ -128,6 +146,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98562", + "name": "RHSA-2026:98562", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-92768", "tags": [ @@ -185,7 +211,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T11:49:47.386Z" + "dateUpdated": "2026-11-11T19:08:48.999Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/94xxx/CVE-2026-94125.json b/data/2026/94xxx/CVE-2026-94125.json index 438bcc126f..c015a123d9 100644 --- a/data/2026/94xxx/CVE-2026-94125.json +++ b/data/2026/94xxx/CVE-2026-94125.json @@ -8,7 +8,7 @@ "assignerShortName": "apache", "dateReserved": "2026-09-20T16:04:39.818Z", "datePublished": "2026-11-11T12:34:27.000Z", - "dateUpdated": "2026-11-11T12:34:27.000Z" + "dateUpdated": "2026-11-11T19:05:36.527Z" }, "containers": { "cna": { @@ -98,6 +98,21 @@ "x_generator": { "engine": "Vulnogram 1.0.3" } - } + }, + "adp": [ + { + "title": "CVE Program Container", + "references": [ + { + "url": "http://www.openwall.com/lists/oss-security/2026/11/11/3" + } + ], + "providerMetadata": { + "orgId": "af854a3a-2127-422b-91ae-364da2661108", + "shortName": "CVE", + "dateUpdated": "2026-11-11T19:05:36.527Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/95xxx/CVE-2026-95619.json b/data/2026/95xxx/CVE-2026-95619.json index cb407bff48..8df5a29873 100644 --- a/data/2026/95xxx/CVE-2026-95619.json +++ b/data/2026/95xxx/CVE-2026-95619.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-22T10:25:12.951Z", "datePublished": "2026-09-22T12:52:02.140Z", - "dateUpdated": "2026-11-11T12:06:27.006Z" + "dateUpdated": "2026-11-11T19:17:12.123Z" }, "containers": { "cna": { @@ -128,6 +128,26 @@ "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:11.5.0-15.el9_8", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:rhel_eus:9.8::appstream", + "cpe:/a:redhat:rhel_eus:9.8::crb", + "cpe:/o:redhat:rhel_eus:9.8::baseos" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Hardened Images", @@ -688,6 +708,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99032", + "name": "RHSA-2026:99032", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-95619", "tags": [ @@ -739,7 +767,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:06:27.006Z" + "dateUpdated": "2026-11-11T19:17:12.123Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/96xxx/CVE-2026-96275.json b/data/2026/96xxx/CVE-2026-96275.json index c12c39b55b..22a3e262b6 100644 --- a/data/2026/96xxx/CVE-2026-96275.json +++ b/data/2026/96xxx/CVE-2026-96275.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-22T20:42:17.038Z", "datePublished": "2026-09-23T15:01:38.344Z", - "dateUpdated": "2026-11-11T13:37:25.264Z" + "dateUpdated": "2026-11-11T18:31:59.737Z" }, "containers": { "cna": { @@ -102,6 +102,24 @@ "cpe:/o:redhat:enterprise_linux_eus:10.0" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.12.9-6.el7_9", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:rhel_els:7" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -327,16 +345,6 @@ "cpe:/a:redhat:rhel_eus:9.6::appstream", "cpe:/a:redhat:rhel_eus:9.6::crb" ] - }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 7", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "flatpak", - "defaultStatus": "affected", - "cpes": [ - "cpe:/o:redhat:rhel_els:7" - ] } ], "references": [ @@ -436,6 +444,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99010", + "name": "RHSA-2026:99010", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96275", "tags": [ @@ -496,7 +512,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T13:37:25.264Z" + "dateUpdated": "2026-11-11T18:31:59.737Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/96xxx/CVE-2026-96280.json b/data/2026/96xxx/CVE-2026-96280.json index a6c68f38cb..91bcb806cf 100644 --- a/data/2026/96xxx/CVE-2026-96280.json +++ b/data/2026/96xxx/CVE-2026-96280.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-22T20:43:35.900Z", "datePublished": "2026-09-27T20:19:12.890Z", - "dateUpdated": "2026-11-11T13:37:39.770Z" + "dateUpdated": "2026-11-11T19:13:46.091Z" }, "containers": { "cna": { @@ -102,6 +102,24 @@ "cpe:/o:redhat:enterprise_linux_eus:10.0" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.12.9-6.el7_9", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:rhel_els:7" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -327,16 +345,6 @@ "cpe:/a:redhat:rhel_eus:9.6::appstream", "cpe:/a:redhat:rhel_eus:9.6::crb" ] - }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 7", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "flatpak", - "defaultStatus": "affected", - "cpes": [ - "cpe:/o:redhat:rhel_els:7" - ] } ], "references": [ @@ -436,6 +444,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99010", + "name": "RHSA-2026:99010", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96280", "tags": [ @@ -496,7 +512,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T13:37:39.770Z" + "dateUpdated": "2026-11-11T19:13:46.091Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/96xxx/CVE-2026-96577.json b/data/2026/96xxx/CVE-2026-96577.json index 294e36a98d..2ae62ff747 100644 --- a/data/2026/96xxx/CVE-2026-96577.json +++ b/data/2026/96xxx/CVE-2026-96577.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-23T13:30:40.232Z", "datePublished": "2026-10-01T09:17:53.758Z", - "dateUpdated": "2026-10-15T19:14:07.232Z" + "dateUpdated": "2026-11-11T18:44:27.978Z" }, "containers": { "cna": { @@ -147,6 +147,16 @@ "cpes": [ "cpe:/a:redhat:assisted_installer:2" ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat OpenShift Container Platform 5", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "openshift5/oc-mirror-plugin-rhel9", + "defaultStatus": "affected", + "cpes": [ + "cpe:/a:redhat:openshift:5" + ] } ], "references": [ @@ -212,14 +222,14 @@ "descriptions": [ { "cweId": "CWE-306", - "description": "Missing Authentication for Critical Function", + "description": "Missing Authentication for Critical Functionality", "lang": "en", "type": "CWE" } ] } ], - "x_redhatCweChain": "CWE-306: Missing Authentication for Critical Function", + "x_redhatCweChain": "CWE-306: Missing Authentication for Critical Functionality", "workarounds": [ { "lang": "en", @@ -241,7 +251,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-10-15T19:14:07.232Z" + "dateUpdated": "2026-11-11T18:44:27.978Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/delta.json b/data/delta.json index 773661db92..6252976ae2 100644 --- a/data/delta.json +++ b/data/delta.json @@ -1,86 +1,25 @@ { - "fetchTime": "2026-11-11T18:22:25.052Z", - "numberOfChanges": 13, - "new": [ - { - "cveId": "CVE-2026-123863", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123863", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123863.json", - "dateUpdated": "2026-11-11T18:16:12.733Z" - }, - { - "cveId": "CVE-2026-123864", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123864", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123864.json", - "dateUpdated": "2026-11-11T18:17:56.773Z" - }, - { - "cveId": "CVE-2026-123865", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123865", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123865.json", - "dateUpdated": "2026-11-11T18:19:36.284Z" - }, - { - "cveId": "CVE-2026-123866", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123866", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123866.json", - "dateUpdated": "2026-11-11T18:21:18.538Z" - }, - { - "cveId": "CVE-2026-57500", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-57500", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/57xxx/CVE-2026-57500.json", - "dateUpdated": "2026-11-11T18:16:09.800Z" - }, - { - "cveId": "CVE-2026-58505", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58505", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58505.json", - "dateUpdated": "2026-11-11T18:19:59.296Z" - }, - { - "cveId": "CVE-2026-91874", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91874", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91874.json", - "dateUpdated": "2026-11-11T18:15:36.584Z" - }, - { - "cveId": "CVE-2026-91875", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91875", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91875.json", - "dateUpdated": "2026-11-11T18:19:18.379Z" - } - ], + "fetchTime": "2026-11-11T19:20:17.698Z", + "numberOfChanges": 3, + "new": [], "updated": [ { - "cveId": "CVE-2026-107154", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107154", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107154.json", - "dateUpdated": "2026-11-11T18:19:29.799Z" + "cveId": "CVE-2026-102010", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102010", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102010.json", + "dateUpdated": "2026-11-11T19:17:05.819Z" }, { - "cveId": "CVE-2026-107155", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107155", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107155.json", - "dateUpdated": "2026-11-11T18:19:54.128Z" + "cveId": "CVE-2026-32148", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-32148", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32148.json", + "dateUpdated": "2026-11-11T19:17:12.374Z" }, { - "cveId": "CVE-2026-77708", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-77708", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77708.json", - "dateUpdated": "2026-11-11T18:17:11.033Z" - }, - { - "cveId": "CVE-2026-77709", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-77709", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77709.json", - "dateUpdated": "2026-11-11T18:16:13.636Z" - }, - { - "cveId": "CVE-2026-82308", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-82308", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82308.json", - "dateUpdated": "2026-11-11T18:18:32.865Z" + "cveId": "CVE-2026-95619", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-95619", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95619.json", + "dateUpdated": "2026-11-11T19:17:12.123Z" } ], "error": [] diff --git a/data/deltaLog.json b/data/deltaLog.json index 74a283a70d..84a963ece1 100644 --- a/data/deltaLog.json +++ b/data/deltaLog.json @@ -1,4 +1,554 @@ [ + { + "fetchTime": "2026-11-11T19:20:17.698Z", + "numberOfChanges": 3, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-102010", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102010", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102010.json", + "dateUpdated": "2026-11-11T19:17:05.819Z" + }, + { + "cveId": "CVE-2026-32148", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-32148", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32148.json", + "dateUpdated": "2026-11-11T19:17:12.374Z" + }, + { + "cveId": "CVE-2026-95619", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-95619", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95619.json", + "dateUpdated": "2026-11-11T19:17:12.123Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T19:14:14.676Z", + "numberOfChanges": 14, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-114690", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114690", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114690.json", + "dateUpdated": "2026-11-11T19:13:07.221Z" + }, + { + "cveId": "CVE-2026-114691", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114691", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114691.json", + "dateUpdated": "2026-11-11T19:13:07.528Z" + }, + { + "cveId": "CVE-2026-115455", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115455", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115455.json", + "dateUpdated": "2026-11-11T19:13:07.953Z" + }, + { + "cveId": "CVE-2026-125346", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125346", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125346.json", + "dateUpdated": "2026-11-11T19:08:04.293Z" + }, + { + "cveId": "CVE-2026-42790", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42790", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42790.json", + "dateUpdated": "2026-11-11T19:13:56.207Z" + }, + { + "cveId": "CVE-2026-42791", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42791", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42791.json", + "dateUpdated": "2026-11-11T19:11:15.974Z" + }, + { + "cveId": "CVE-2026-42792", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42792", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42792.json", + "dateUpdated": "2026-11-11T19:09:12.847Z" + }, + { + "cveId": "CVE-2026-76235", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76235", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76235.json", + "dateUpdated": "2026-11-11T19:09:04.604Z" + }, + { + "cveId": "CVE-2026-85013", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85013", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85013.json", + "dateUpdated": "2026-11-11T19:08:54.330Z" + }, + { + "cveId": "CVE-2026-91147", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91147", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91147.json", + "dateUpdated": "2026-11-11T19:09:05.520Z" + }, + { + "cveId": "CVE-2026-92745", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92745", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92745.json", + "dateUpdated": "2026-11-11T19:08:48.083Z" + }, + { + "cveId": "CVE-2026-92747", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92747", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92747.json", + "dateUpdated": "2026-11-11T19:08:49.016Z" + }, + { + "cveId": "CVE-2026-92768", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92768", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92768.json", + "dateUpdated": "2026-11-11T19:08:48.999Z" + }, + { + "cveId": "CVE-2026-96280", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96280", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96280.json", + "dateUpdated": "2026-11-11T19:13:46.091Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T19:06:39.743Z", + "numberOfChanges": 19, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-106023", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106023", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106023.json", + "dateUpdated": "2026-11-11T19:05:04.256Z" + }, + { + "cveId": "CVE-2026-111792", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111792", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111792.json", + "dateUpdated": "2026-11-11T19:05:05.609Z" + }, + { + "cveId": "CVE-2026-119618", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119618", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119618.json", + "dateUpdated": "2026-11-11T19:05:06.932Z" + }, + { + "cveId": "CVE-2026-123747", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123747", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123747.json", + "dateUpdated": "2026-11-11T19:05:08.251Z" + }, + { + "cveId": "CVE-2026-124310", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124310", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124310.json", + "dateUpdated": "2026-11-11T19:05:12.002Z" + }, + { + "cveId": "CVE-2026-124312", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124312", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124312.json", + "dateUpdated": "2026-11-11T19:05:13.297Z" + }, + { + "cveId": "CVE-2026-124495", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124495", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124495.json", + "dateUpdated": "2026-11-11T19:05:14.626Z" + }, + { + "cveId": "CVE-2026-124496", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124496", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124496.json", + "dateUpdated": "2026-11-11T19:05:15.942Z" + }, + { + "cveId": "CVE-2026-125346", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125346", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125346.json", + "dateUpdated": "2026-11-11T19:04:07.862Z" + }, + { + "cveId": "CVE-2026-125704", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125704", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125704.json", + "dateUpdated": "2026-11-11T19:00:58.688Z" + }, + { + "cveId": "CVE-2026-126627", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126627", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126627.json", + "dateUpdated": "2026-11-11T19:05:17.239Z" + }, + { + "cveId": "CVE-2026-40853", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-40853", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/40xxx/CVE-2026-40853.json", + "dateUpdated": "2026-11-11T19:05:28.615Z" + }, + { + "cveId": "CVE-2026-44929", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-44929", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/44xxx/CVE-2026-44929.json", + "dateUpdated": "2026-11-11T19:05:29.921Z" + }, + { + "cveId": "CVE-2026-48858", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-48858", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48858.json", + "dateUpdated": "2026-11-11T19:05:09.624Z" + }, + { + "cveId": "CVE-2026-49236", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-49236", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49236.json", + "dateUpdated": "2026-11-11T19:05:31.224Z" + }, + { + "cveId": "CVE-2026-71395", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-71395", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71395.json", + "dateUpdated": "2026-11-11T19:05:32.557Z" + }, + { + "cveId": "CVE-2026-89326", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89326", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89326.json", + "dateUpdated": "2026-11-11T19:05:33.889Z" + }, + { + "cveId": "CVE-2026-90993", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90993", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90993.json", + "dateUpdated": "2026-11-11T19:05:35.223Z" + }, + { + "cveId": "CVE-2026-94125", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-94125", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94125.json", + "dateUpdated": "2026-11-11T19:05:36.527Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T18:58:24.278Z", + "numberOfChanges": 2, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-53422", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-53422", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53422.json", + "dateUpdated": "2026-11-11T18:58:19.012Z" + }, + { + "cveId": "CVE-2026-54886", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54886", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54886.json", + "dateUpdated": "2026-11-11T18:55:39.707Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T18:52:34.433Z", + "numberOfChanges": 3, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-54887", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54887", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54887.json", + "dateUpdated": "2026-11-11T18:50:00.580Z" + }, + { + "cveId": "CVE-2026-54890", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54890", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54890.json", + "dateUpdated": "2026-11-11T18:47:44.385Z" + }, + { + "cveId": "CVE-2026-59251", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-59251", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59251.json", + "dateUpdated": "2026-11-11T18:52:31.905Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T18:46:47.244Z", + "numberOfChanges": 10, + "new": [ + { + "cveId": "CVE-2026-126774", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126774", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126774.json", + "dateUpdated": "2026-11-11T18:41:07.073Z" + }, + { + "cveId": "CVE-2026-126775", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126775", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126775.json", + "dateUpdated": "2026-11-11T18:41:07.737Z" + }, + { + "cveId": "CVE-2026-126776", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126776", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126776.json", + "dateUpdated": "2026-11-11T18:41:08.401Z" + }, + { + "cveId": "CVE-2026-126777", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126777", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126777.json", + "dateUpdated": "2026-11-11T18:41:09.011Z" + }, + { + "cveId": "CVE-2026-126778", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126778", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126778.json", + "dateUpdated": "2026-11-11T18:41:09.623Z" + }, + { + "cveId": "CVE-2026-126779", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126779", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126779.json", + "dateUpdated": "2026-11-11T18:41:10.254Z" + }, + { + "cveId": "CVE-2026-126780", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126780", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126780.json", + "dateUpdated": "2026-11-11T18:41:10.880Z" + }, + { + "cveId": "CVE-2026-126781", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126781", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126781.json", + "dateUpdated": "2026-11-11T18:41:11.509Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-55737", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-55737", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55737.json", + "dateUpdated": "2026-11-11T18:45:35.184Z" + }, + { + "cveId": "CVE-2026-96577", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96577", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96577.json", + "dateUpdated": "2026-11-11T18:44:27.978Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T18:40:59.471Z", + "numberOfChanges": 6, + "new": [ + { + "cveId": "CVE-2026-108472", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108472", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108472.json", + "dateUpdated": "2026-11-11T18:38:17.370Z" + }, + { + "cveId": "CVE-2026-126051", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126051", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126051.json", + "dateUpdated": "2026-11-11T18:35:45.777Z" + }, + { + "cveId": "CVE-2026-91150", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91150", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91150.json", + "dateUpdated": "2026-11-11T18:38:12.565Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-125712", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125712", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125712.json", + "dateUpdated": "2026-11-11T18:35:56.566Z" + }, + { + "cveId": "CVE-2026-84725", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84725", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84725.json", + "dateUpdated": "2026-11-11T18:37:36.813Z" + }, + { + "cveId": "CVE-2026-86476", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86476", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86476.json", + "dateUpdated": "2026-11-11T18:35:47.670Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T18:35:09.930Z", + "numberOfChanges": 12, + "new": [ + { + "cveId": "CVE-2026-123747", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123747", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123747.json", + "dateUpdated": "2026-11-11T18:31:49.765Z" + }, + { + "cveId": "CVE-2026-123872", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123872", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123872.json", + "dateUpdated": "2026-11-11T18:30:25.193Z" + }, + { + "cveId": "CVE-2026-123874", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123874", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123874.json", + "dateUpdated": "2026-11-11T18:32:20.292Z" + }, + { + "cveId": "CVE-2026-123875", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123875", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123875.json", + "dateUpdated": "2026-11-11T18:33:57.475Z" + }, + { + "cveId": "CVE-2026-123877", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123877", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123877.json", + "dateUpdated": "2026-11-11T18:28:38.494Z" + }, + { + "cveId": "CVE-2026-65840", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65840", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65840.json", + "dateUpdated": "2026-11-11T18:32:50.465Z" + }, + { + "cveId": "CVE-2026-65843", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65843", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65843.json", + "dateUpdated": "2026-11-11T18:29:55.356Z" + }, + { + "cveId": "CVE-2026-65967", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65967", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65967.json", + "dateUpdated": "2026-11-11T18:33:09.909Z" + }, + { + "cveId": "CVE-2026-91873", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91873", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91873.json", + "dateUpdated": "2026-11-11T18:33:07.957Z" + }, + { + "cveId": "CVE-2026-91878", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91878", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91878.json", + "dateUpdated": "2026-11-11T18:29:41.098Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-12977", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12977", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12977.json", + "dateUpdated": "2026-11-11T18:32:39.533Z" + }, + { + "cveId": "CVE-2026-96275", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96275", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96275.json", + "dateUpdated": "2026-11-11T18:31:59.737Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T18:28:18.134Z", + "numberOfChanges": 10, + "new": [ + { + "cveId": "CVE-2026-119055", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119055", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119055.json", + "dateUpdated": "2026-11-11T18:28:11.702Z" + }, + { + "cveId": "CVE-2026-123867", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123867", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123867.json", + "dateUpdated": "2026-11-11T18:23:12.991Z" + }, + { + "cveId": "CVE-2026-123868", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123868", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123868.json", + "dateUpdated": "2026-11-11T18:25:01.907Z" + }, + { + "cveId": "CVE-2026-123871", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123871", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123871.json", + "dateUpdated": "2026-11-11T18:26:51.700Z" + }, + { + "cveId": "CVE-2026-61637", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-61637", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/61xxx/CVE-2026-61637.json", + "dateUpdated": "2026-11-11T18:26:59.587Z" + }, + { + "cveId": "CVE-2026-65833", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65833", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65833.json", + "dateUpdated": "2026-11-11T18:23:41.315Z" + }, + { + "cveId": "CVE-2026-91876", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91876", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91876.json", + "dateUpdated": "2026-11-11T18:22:41.165Z" + }, + { + "cveId": "CVE-2026-91877", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91877", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91877.json", + "dateUpdated": "2026-11-11T18:26:11.121Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-84268", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84268", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84268.json", + "dateUpdated": "2026-11-11T18:26:14.101Z" + }, + { + "cveId": "CVE-2026-88924", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-88924", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88924.json", + "dateUpdated": "2026-11-11T18:26:19.179Z" + } + ], + "error": [] + }, { "fetchTime": "2026-11-11T18:22:25.052Z", "numberOfChanges": 13, @@ -848099,236 +848649,5 @@ } ], "error": [] - }, - { - "fetchTime": "2026-10-12T19:19:18.102Z", - "numberOfChanges": 8, - "new": [ - { - "cveId": "CVE-2025-27895", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-27895", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/27xxx/CVE-2025-27895.json", - "dateUpdated": "2026-10-12T19:07:08.547Z" - }, - { - "cveId": "CVE-2025-27896", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-27896", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/27xxx/CVE-2025-27896.json", - "dateUpdated": "2026-10-12T19:06:53.450Z" - }, - { - "cveId": "CVE-2025-27897", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-27897", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/27xxx/CVE-2025-27897.json", - "dateUpdated": "2026-10-12T19:05:52.937Z" - }, - { - "cveId": "CVE-2025-27902", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-27902", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/27xxx/CVE-2025-27902.json", - "dateUpdated": "2026-10-12T19:04:45.574Z" - }, - { - "cveId": "CVE-2026-104332", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104332", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104332.json", - "dateUpdated": "2026-10-12T19:18:01.600Z" - }, - { - "cveId": "CVE-2026-108361", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108361", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108361.json", - "dateUpdated": "2026-10-12T19:06:20.005Z" - }, - { - "cveId": "CVE-2026-108362", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108362", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108362.json", - "dateUpdated": "2026-10-12T19:06:11.348Z" - }, - { - "cveId": "CVE-2026-108923", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108923", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108923.json", - "dateUpdated": "2026-10-12T19:15:12.593Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T19:02:12.769Z", - "numberOfChanges": 1, - "new": [ - { - "cveId": "CVE-2026-108922", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108922", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108922.json", - "dateUpdated": "2026-10-12T19:00:11.131Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T18:54:15.024Z", - "numberOfChanges": 18, - "new": [ - { - "cveId": "CVE-2026-102663", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102663", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102663.json", - "dateUpdated": "2026-10-12T18:49:23.454Z" - }, - { - "cveId": "CVE-2026-104355", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104355", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104355.json", - "dateUpdated": "2026-10-12T18:43:33.846Z" - }, - { - "cveId": "CVE-2026-105464", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105464", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105464.json", - "dateUpdated": "2026-10-12T18:46:15.251Z" - }, - { - "cveId": "CVE-2026-105465", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105465", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105465.json", - "dateUpdated": "2026-10-12T18:41:42.131Z" - }, - { - "cveId": "CVE-2026-105466", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105466", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105466.json", - "dateUpdated": "2026-10-12T18:42:55.982Z" - }, - { - "cveId": "CVE-2026-108921", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108921", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108921.json", - "dateUpdated": "2026-10-12T18:45:15.546Z" - }, - { - "cveId": "CVE-2026-18166", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18166", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18166.json", - "dateUpdated": "2026-10-12T18:47:16.980Z" - }, - { - "cveId": "CVE-2026-57118", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-57118", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/57xxx/CVE-2026-57118.json", - "dateUpdated": "2026-10-12T18:48:22.664Z" - }, - { - "cveId": "CVE-2026-57143", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-57143", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/57xxx/CVE-2026-57143.json", - "dateUpdated": "2026-10-12T18:48:00.429Z" - }, - { - "cveId": "CVE-2026-59976", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-59976", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59976.json", - "dateUpdated": "2026-10-12T18:36:12.583Z" - }, - { - "cveId": "CVE-2026-59977", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-59977", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59977.json", - "dateUpdated": "2026-10-12T18:35:18.863Z" - }, - { - "cveId": "CVE-2026-65954", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65954", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65954.json", - "dateUpdated": "2026-10-12T18:51:01.522Z" - }, - { - "cveId": "CVE-2026-78404", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-78404", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/78xxx/CVE-2026-78404.json", - "dateUpdated": "2026-10-12T18:39:43.343Z" - }, - { - "cveId": "CVE-2026-83535", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-83535", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83535.json", - "dateUpdated": "2026-10-12T18:50:25.262Z" - }, - { - "cveId": "CVE-2026-83536", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-83536", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83536.json", - "dateUpdated": "2026-10-12T18:50:23.855Z" - }, - { - "cveId": "CVE-2026-85471", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85471", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85471.json", - "dateUpdated": "2026-10-12T18:50:20.163Z" - }, - { - "cveId": "CVE-2026-87744", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-87744", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87744.json", - "dateUpdated": "2026-10-12T18:41:46.751Z" - }, - { - "cveId": "CVE-2026-89140", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89140", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89140.json", - "dateUpdated": "2026-10-12T18:44:23.032Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T18:34:52.664Z", - "numberOfChanges": 6, - "new": [ - { - "cveId": "CVE-2026-103061", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103061", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103061.json", - "dateUpdated": "2026-10-12T18:23:41.507Z" - }, - { - "cveId": "CVE-2026-104102", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104102", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104102.json", - "dateUpdated": "2026-10-12T18:32:00.821Z" - }, - { - "cveId": "CVE-2026-107226", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107226", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107226.json", - "dateUpdated": "2026-10-12T18:34:18.996Z" - }, - { - "cveId": "CVE-2026-108919", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108919", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108919.json", - "dateUpdated": "2026-10-12T18:15:14.415Z" - }, - { - "cveId": "CVE-2026-108920", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108920", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108920.json", - "dateUpdated": "2026-10-12T18:30:15.514Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-105274", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105274", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105274.json", - "dateUpdated": "2026-10-12T18:16:57.155Z" - } - ], - "error": [] } ] \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index 8a10ba64f1..ce5ed1ebf4 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,7 +1,7 @@ { "source": "https://github.com/CVEProject/cvelistV5.git", - "upstream_commit": "ab5e7f24b4168f4ef0944520442e16d3177bde04", + "upstream_commit": "e837c189ec6ea3d81311ba14470ac266d207914b", "since_year": 2017, - "records": 331109, - "synced_at_utc": "2026-11-11T18:34:23.141495+00:00" + "records": 331138, + "synced_at_utc": "2026-11-11T19:28:45.564331+00:00" }