diff --git a/data/2024/12xxx/CVE-2024-12741.json b/data/2024/12xxx/CVE-2024-12741.json index 6ab5d12f2a..a69b619485 100644 --- a/data/2024/12xxx/CVE-2024-12741.json +++ b/data/2024/12xxx/CVE-2024-12741.json @@ -1,6 +1,6 @@ { "dataType": "CVE_RECORD", - "dataVersion": "5.1", + "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-12741", "assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4", @@ -8,47 +8,28 @@ "assignerShortName": "NI", "dateReserved": "2024-12-17T20:53:13.401Z", "datePublished": "2024-12-18T19:20:41.889Z", - "dateUpdated": "2025-03-06T16:18:31.635Z" + "dateUpdated": "2026-11-11T15:23:56.259Z" }, "containers": { "cna": { - "affected": [ + "providerMetadata": { + "orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4", + "shortName": "NI", + "dateUpdated": "2026-11-11T15:23:56.259Z" + }, + "title": "Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File", + "problemTypes": [ { - "defaultStatus": "unaffected", - "platforms": [ - "Windows" - ], - "product": "DAQExpress", - "vendor": "NI", - "versions": [ + "descriptions": [ { - "status": "affected", - "version": "0", - "versionType": "semver" + "lang": "en", + "cweId": "CWE-502", + "description": "CWE-502 Deserialization of Untrusted Data", + "type": "CWE" } ] } ], - "credits": [ - { - "lang": "en", - "type": "finder", - "value": "kimiya working with Trend Micro Zero Day Initiative" - } - ], - "descriptions": [ - { - "lang": "en", - "supportingMedia": [ - { - "base64": false, - "type": "text/html", - "value": "

A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions.  Please note that DAQExpress is an EOL product and will not receive any updates.

" - } - ], - "value": "A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions.  Please note that DAQExpress is an EOL product and will not receive any updates." - } - ], "impacts": [ { "capecId": "CAPEC-586", @@ -60,92 +41,113 @@ ] } ], - "metrics": [ + "affected": [ { - "cvssV3_1": { - "attackComplexity": "LOW", - "attackVector": "LOCAL", - "availabilityImpact": "HIGH", - "baseScore": 7.8, - "baseSeverity": "HIGH", - "confidentialityImpact": "HIGH", - "integrityImpact": "HIGH", - "privilegesRequired": "NONE", - "scope": "UNCHANGED", - "userInteraction": "REQUIRED", - "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", - "version": "3.1" - }, - "format": "CVSS", - "scenarios": [ + "vendor": "NI", + "product": "DAQExpress", + "platforms": [ + "Windows" + ], + "versions": [ { - "lang": "en", - "value": "GENERAL" + "status": "affected", + "version": "0", + "lessThanOrEqual": "5.1.0", + "versionType": "semver" } - ] - }, + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ { - "cvssV4_0": { - "Automatable": "NOT_DEFINED", - "Recovery": "NOT_DEFINED", - "Safety": "NOT_DEFINED", - "attackComplexity": "LOW", - "attackRequirements": "NONE", - "attackVector": "LOCAL", - "baseScore": 8.4, - "baseSeverity": "HIGH", - "privilegesRequired": "NONE", - "providerUrgency": "NOT_DEFINED", - "subAvailabilityImpact": "NONE", - "subConfidentialityImpact": "NONE", - "subIntegrityImpact": "NONE", - "userInteraction": "ACTIVE", - "valueDensity": "NOT_DEFINED", - "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", - "version": "4.0", - "vulnAvailabilityImpact": "HIGH", - "vulnConfidentialityImpact": "HIGH", - "vulnIntegrityImpact": "HIGH", - "vulnerabilityResponseEffort": "NOT_DEFINED" - }, - "format": "CVSS", - "scenarios": [ + "lang": "en", + "value": "A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions.  Please note that DAQExpress is an EOL product and will not receive any updates.", + "supportingMedia": [ { - "lang": "en", - "value": "GENERAL" + "type": "text/html", + "base64": false, + "value": "

A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions.  Please note that DAQExpress is an EOL product and will not receive any updates.

" } ] } ], - "problemTypes": [ - { - "descriptions": [ - { - "cweId": "CWE-502", - "description": "CWE-502 Deserialization of Untrusted Data", - "lang": "en", - "type": "CWE" - } - ] - } + "tags": [ + "unsupported-when-assigned" ], - "providerMetadata": { - "orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4", - "shortName": "NI", - "dateUpdated": "2025-03-06T16:18:31.635Z" - }, "references": [ { "url": "https://knowledge.ni.com/KnowledgeArticleDetails?id=kA00Z000000kFD7SAM&l=en-US" } ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 7.8, + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "ACTIVE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 8.4, + "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "kimiya working with Trend Micro Zero Day Initiative", + "type": "finder" + } + ], "source": { "discovery": "UNKNOWN" }, - "tags": [ - "unsupported-when-assigned" - ], - "title": "Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File", "x_generator": { "engine": "Vulnogram 0.2.0" } diff --git a/data/2026/100xxx/CVE-2026-100290.json b/data/2026/100xxx/CVE-2026-100290.json new file mode 100644 index 0000000000..05b301c920 --- /dev/null +++ b/data/2026/100xxx/CVE-2026-100290.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-100290", + "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18", + "state": "PUBLISHED", + "assignerShortName": "glibc", + "dateReserved": "2026-09-25T17:30:58.992Z", + "datePublished": "2026-11-11T15:56:08.323Z", + "dateUpdated": "2026-11-11T15:56:08.323Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18", + "shortName": "glibc", + "dateUpdated": "2026-11-11T15:56:08.323Z" + }, + "title": "Double free after allocation failure in regcomp and regexec", + "datePublic": "2026-09-08T05:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-415", + "description": "CWE-415 Double Free", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "The GNU C Library", + "product": "glibc", + "versions": [ + { + "status": "affected", + "version": "2.3", + "lessThanOrEqual": "2.44", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.

An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library." + } + ] + } + ], + "references": [ + { + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34991", + "tags": [ + "issue-tracking" + ] + }, + { + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31935", + "tags": [ + "issue-tracking" + ] + }, + { + "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "LOW", + "baseSeverity": "LOW", + "baseScore": 3.7, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Tristan", + "type": "finder" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "cvelib 1.8.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/105xxx/CVE-2026-105440.json b/data/2026/105xxx/CVE-2026-105440.json new file mode 100644 index 0000000000..f26366d92b --- /dev/null +++ b/data/2026/105xxx/CVE-2026-105440.json @@ -0,0 +1,190 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-105440", + "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", + "state": "PUBLISHED", + "assignerShortName": "ExtremeNetworks", + "dateReserved": "2026-10-05T13:12:24.896Z", + "datePublished": "2026-11-11T15:23:47.991Z", + "dateUpdated": "2026-11-11T15:30:14.813Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", + "shortName": "ExtremeNetworks", + "dateUpdated": "2026-11-11T15:30:14.813Z" + }, + "title": "Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information", + "datePublic": "2026-11-11T15:19:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-862", + "description": "CWE-862 Missing Authorization", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-1", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs" + } + ] + } + ], + "affected": [ + { + "vendor": "Extreme Networks", + "product": "Switch Engine (EXOS)", + "versions": [ + { + "status": "affected", + "version": "33.7.0", + "lessThan": "33.7.1-patch1-11", + "versionType": "custom" + }, + { + "status": "affected", + "version": "33.1.0", + "lessThan": "33.1.100-patch1-9", + "versionType": "custom" + }, + { + "status": "affected", + "version": "32.0.0", + "lessThan": "32.7.4.15-patch1-11", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This issue is fixed in Switch Engine 33.7.1-patch1-11,\n33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.\n\n\n\n\n\n\n\n\nExtreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "

Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This issue is fixed in Switch Engine 33.7.1-patch1-11,\n33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.


Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.

" + } + ] + } + ], + "references": [ + { + "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "HIGH", + "vulnIntegrityImpact": "NONE", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 8.3, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseSeverity": "MEDIUM", + "baseScore": 6.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + } + ], + "workarounds": [ + { + "lang": "en", + "value": "Restrict access to the device management interface to\ntrusted networks and hosts. Disable the web services (JSON-RPC) interface where\nit is not required. Limit read-only accounts to users who require them, and\nenforce strong, unique passwords on all local accounts.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "

Restrict access to the device management interface to\ntrusted networks and hosts. Disable the web services (JSON-RPC) interface where\nit is not required. Limit read-only accounts to users who require them, and\nenforce strong, unique passwords on all local accounts.

" + } + ] + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade\nto Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, or\n32.7.4.15-patch1-11, or later.After\nupgrading, rotate local account passwords, especially administrative accounts.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Upgrade\nto Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, or\n32.7.4.15-patch1-11, or later.
After\nupgrading, rotate local account passwords, especially administrative accounts.
" + } + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Toàn Lê (https://github.com/toanln-cov)", + "type": "finder" + } + ], + "source": { + "advisory": "SA-2026-233", + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/115xxx/CVE-2026-115819.json b/data/2026/115xxx/CVE-2026-115819.json new file mode 100644 index 0000000000..57600b813d --- /dev/null +++ b/data/2026/115xxx/CVE-2026-115819.json @@ -0,0 +1,116 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-115819", + "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18", + "state": "PUBLISHED", + "assignerShortName": "glibc", + "dateReserved": "2026-10-23T16:39:56.857Z", + "datePublished": "2026-11-11T15:36:38.804Z", + "dateUpdated": "2026-11-11T15:36:38.804Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18", + "shortName": "glibc", + "dateUpdated": "2026-11-11T15:36:38.804Z" + }, + "title": "One-byte buffer overflow in wide scanf %s and %[ conversions", + "datePublic": "2026-11-11T05:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-193", + "description": "CWE-193 Off-by-one Error", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "The GNU C Library", + "product": "glibc", + "versions": [ + { + "status": "affected", + "version": "2.2", + "lessThanOrEqual": "2.44", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence. The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte. A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end. The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process. An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon. This issue affects all architectures and ABIs supported by the GNU C Library.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.

These conversions store each wide input character into the caller's char array as a multibyte sequence. The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte. A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end. The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process. An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.

The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon. This issue affects all architectures and ABIs supported by the GNU C Library." + } + ] + } + ], + "references": [ + { + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34989", + "tags": [ + "issue-tracking" + ] + }, + { + "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseSeverity": "MEDIUM", + "baseScore": 4.8, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Russell Miller", + "type": "finder" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "cvelib 1.8.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/119xxx/CVE-2026-119618.json b/data/2026/119xxx/CVE-2026-119618.json index 43d31e1850..8ae2758921 100644 --- a/data/2026/119xxx/CVE-2026-119618.json +++ b/data/2026/119xxx/CVE-2026-119618.json @@ -8,14 +8,14 @@ "assignerShortName": "apache", "dateReserved": "2026-10-30T12:32:13.904Z", "datePublished": "2026-11-11T14:54:08.155Z", - "dateUpdated": "2026-11-11T14:54:08.155Z" + "dateUpdated": "2026-11-11T15:55:23.793Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", - "dateUpdated": "2026-11-11T14:54:08.155Z" + "dateUpdated": "2026-11-11T15:55:23.793Z" }, "title": "Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers", "problemTypes": [ @@ -89,7 +89,12 @@ { "time": "2026-10-26T12:00:00.000Z", "lang": "en", - "value": "reported" + "value": "reported (Anthropic)" + }, + { + "time": "2026-11-03T15:50:00.000Z", + "lang": "en", + "value": "reported (Google)" } ], "credits": [ diff --git a/data/2026/124xxx/CVE-2026-124686.json b/data/2026/124xxx/CVE-2026-124686.json new file mode 100644 index 0000000000..c5e2b79846 --- /dev/null +++ b/data/2026/124xxx/CVE-2026-124686.json @@ -0,0 +1,123 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-124686", + "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", + "state": "PUBLISHED", + "assignerShortName": "ProgressSoftware", + "dateReserved": "2026-11-09T10:41:42.889Z", + "datePublished": "2026-11-11T15:27:32.762Z", + "dateUpdated": "2026-11-11T15:27:32.762Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", + "shortName": "ProgressSoftware", + "dateUpdated": "2026-11-11T15:27:32.762Z" + }, + "title": "JavaScript Code Injection through kendo.init() in Kendo UI for jQuery", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-95", + "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "descriptions": [ + { + "lang": "en", + "value": "Code Injection" + } + ] + } + ], + "affected": [ + { + "vendor": "Progress Software", + "product": "Kendo UI for jQuery", + "versions": [ + { + "status": "affected", + "version": "2022.3.1109", + "lessThan": "2026.4.1111", + "versionType": "custom" + }, + { + "status": "unaffected", + "version": "2026.4.1111" + } + ], + "defaultStatus": "unknown" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user's browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user's browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.

" + } + ] + } + ], + "references": [ + { + "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-init-code-injection-cve-2026-124686", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseSeverity": "MEDIUM", + "baseScore": 5.4, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)", + "type": "finder" + } + ], + "source": { + "discovery": "EXTERNAL" + }, + "x_generator": { + "engine": "Vulnogram 0.2.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/64xxx/CVE-2026-64855.json b/data/2026/64xxx/CVE-2026-64855.json new file mode 100644 index 0000000000..5d05903684 --- /dev/null +++ b/data/2026/64xxx/CVE-2026-64855.json @@ -0,0 +1,108 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-64855", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-20T18:31:39.291Z", + "datePublished": "2026-11-11T15:48:16.347Z", + "dateUpdated": "2026-11-11T15:48:16.347Z" + }, + "containers": { + "cna": { + "title": "soapbar: verify_envelope_bsp accepts an unauthenticated embedded certificate (signature forgery / authentication bypass)", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-295", + "lang": "en", + "description": "CWE-295: Improper Certificate Validation", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-347", + "lang": "en", + "description": "CWE-347: Improper Verification of Cryptographic Signature", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/hitoshyamamoto/soapbar/security/advisories/GHSA-859w-52fx-hcm6", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/hitoshyamamoto/soapbar/security/advisories/GHSA-859w-52fx-hcm6" + }, + { + "name": "https://github.com/hitoshyamamoto/soapbar/pull/71", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/hitoshyamamoto/soapbar/pull/71" + }, + { + "name": "https://github.com/hitoshyamamoto/soapbar/releases/tag/v0.13.0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/hitoshyamamoto/soapbar/releases/tag/v0.13.0" + } + ], + "affected": [ + { + "vendor": "hitoshyamamoto", + "product": "soapbar", + "versions": [ + { + "version": "< 0.13.0", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T15:48:16.347Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A successful verify_envelope_bsp() therefore proved only that the envelope was signed by whoever supplied the embedded certificate — never that it was signed by a trusted party. An attacker who mints their own certificate, signs a forged envelope, and embeds that certificate in the token passes verification. Any consumer that treats a successful BSP verification as authentication can be impersonated (signature forgery / authentication bypass). verify_envelope() (which pins a caller-supplied x509_cert) was not affected — the flaw was specific to the BSP variant whose trust anchor came from the message. This issue has been patched in version 0.13.0." + } + ], + "source": { + "advisory": "GHSA-859w-52fx-hcm6", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/8xxx/CVE-2026-8398.json b/data/2026/8xxx/CVE-2026-8398.json index f7e1654d64..9f71e78a07 100644 --- a/data/2026/8xxx/CVE-2026-8398.json +++ b/data/2026/8xxx/CVE-2026-8398.json @@ -8,14 +8,14 @@ "assignerShortName": "Kaspersky", "dateReserved": "2026-05-12T13:20:16.358Z", "datePublished": "2026-05-15T07:30:29.287Z", - "dateUpdated": "2026-05-28T03:55:20.809Z" + "dateUpdated": "2026-11-11T15:28:05.468Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", "shortName": "Kaspersky", - "dateUpdated": "2026-05-15T07:30:29.287Z" + "dateUpdated": "2026-11-11T15:28:05.468Z" }, "problemTypes": [ { @@ -40,7 +40,7 @@ { "version": "12.5.0.2421", "versionType": "semver", - "lessThan": "2.6.0.*", + "lessThan": "12.6.0.*", "status": "affected" } ], diff --git a/data/2026/96xxx/CVE-2026-96760.json b/data/2026/96xxx/CVE-2026-96760.json index e1b76837da..39275a1588 100644 --- a/data/2026/96xxx/CVE-2026-96760.json +++ b/data/2026/96xxx/CVE-2026-96760.json @@ -8,7 +8,7 @@ "assignerShortName": "certcc", "dateReserved": "2026-09-23T15:59:27.145Z", "datePublished": "2026-09-28T19:37:58.973Z", - "dateUpdated": "2026-10-01T13:58:32.806Z" + "dateUpdated": "2026-11-11T15:46:59.138Z" }, "containers": { "cna": { @@ -16,7 +16,7 @@ "descriptions": [ { "lang": "en", - "value": "Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key." + "value": "Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key." } ], "source": { @@ -29,7 +29,7 @@ "versions": [ { "status": "affected", - "version": "1.7.2" + "version": "1.8.0" } ] } @@ -77,14 +77,14 @@ } ], "x_generator": { - "engine": "VINCE 3.0.49", + "engine": "VINCE 4.0.2", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-96760" }, "providerMetadata": { "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", - "dateUpdated": "2026-09-28T19:37:58.973Z" + "dateUpdated": "2026-11-11T15:46:59.138Z" } }, "adp": [ diff --git a/data/delta.json b/data/delta.json index c21ccd3549..88a588e42e 100644 --- a/data/delta.json +++ b/data/delta.json @@ -1,261 +1,14 @@ { - "fetchTime": "2026-11-11T15:13:17.902Z", - "numberOfChanges": 42, + "fetchTime": "2026-11-11T16:01:34.892Z", + "numberOfChanges": 1, "new": [ { - "cveId": "CVE-2026-102589", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102589", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102589.json", - "dateUpdated": "2026-11-11T15:03:07.435Z" - }, - { - "cveId": "CVE-2026-110289", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110289", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110289.json", - "dateUpdated": "2026-11-11T15:03:27.711Z" - }, - { - "cveId": "CVE-2026-111024", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111024", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111024.json", - "dateUpdated": "2026-11-11T15:02:47.099Z" - }, - { - "cveId": "CVE-2026-124746", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124746", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124746.json", - "dateUpdated": "2026-11-11T15:03:07.440Z" - }, - { - "cveId": "CVE-2026-126325", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126325", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126325.json", - "dateUpdated": "2026-11-11T15:02:56.037Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-121014", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121014", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121014.json", - "dateUpdated": "2026-11-11T15:12:51.144Z" - }, - { - "cveId": "CVE-2026-121028", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121028", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121028.json", - "dateUpdated": "2026-11-11T15:12:18.443Z" - }, - { - "cveId": "CVE-2026-121574", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121574", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121574.json", - "dateUpdated": "2026-11-11T15:12:34.065Z" - }, - { - "cveId": "CVE-2026-121663", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121663", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121663.json", - "dateUpdated": "2026-11-11T15:06:27.495Z" - }, - { - "cveId": "CVE-2026-121665", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121665", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121665.json", - "dateUpdated": "2026-11-11T15:07:01.946Z" - }, - { - "cveId": "CVE-2026-121668", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121668", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121668.json", - "dateUpdated": "2026-11-11T15:06:44.002Z" - }, - { - "cveId": "CVE-2026-121680", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121680", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121680.json", - "dateUpdated": "2026-11-11T15:06:05.247Z" - }, - { - "cveId": "CVE-2026-122164", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122164", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122164.json", - "dateUpdated": "2026-11-11T15:05:44.674Z" - }, - { - "cveId": "CVE-2026-122169", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122169", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122169.json", - "dateUpdated": "2026-11-11T15:05:26.222Z" - }, - { - "cveId": "CVE-2026-122177", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122177", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122177.json", - "dateUpdated": "2026-11-11T15:05:09.787Z" - }, - { - "cveId": "CVE-2026-123481", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123481", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123481.json", - "dateUpdated": "2026-11-11T15:07:40.974Z" - }, - { - "cveId": "CVE-2026-124255", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124255", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124255.json", - "dateUpdated": "2026-11-11T15:11:31.322Z" - }, - { - "cveId": "CVE-2026-124261", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124261", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124261.json", - "dateUpdated": "2026-11-11T15:09:18.796Z" - }, - { - "cveId": "CVE-2026-124262", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124262", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124262.json", - "dateUpdated": "2026-11-11T15:10:59.630Z" - }, - { - "cveId": "CVE-2026-124269", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124269", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124269.json", - "dateUpdated": "2026-11-11T15:10:43.528Z" - }, - { - "cveId": "CVE-2026-124416", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124416", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124416.json", - "dateUpdated": "2026-11-11T15:08:29.559Z" - }, - { - "cveId": "CVE-2026-124417", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124417", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124417.json", - "dateUpdated": "2026-11-11T15:10:27.257Z" - }, - { - "cveId": "CVE-2026-124421", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124421", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124421.json", - "dateUpdated": "2026-11-11T15:11:15.851Z" - }, - { - "cveId": "CVE-2026-124753", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124753", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124753.json", - "dateUpdated": "2026-11-11T15:11:47.464Z" - }, - { - "cveId": "CVE-2026-125046", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125046", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125046.json", - "dateUpdated": "2026-11-11T15:06:16.899Z" - }, - { - "cveId": "CVE-2026-125431", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125431", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125431.json", - "dateUpdated": "2026-11-11T15:09:02.494Z" - }, - { - "cveId": "CVE-2026-125435", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125435", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125435.json", - "dateUpdated": "2026-11-11T15:10:10.945Z" - }, - { - "cveId": "CVE-2026-125436", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125436", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125436.json", - "dateUpdated": "2026-11-11T15:08:12.885Z" - }, - { - "cveId": "CVE-2026-125437", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125437", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125437.json", - "dateUpdated": "2026-11-11T15:12:02.981Z" - }, - { - "cveId": "CVE-2026-125448", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125448", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125448.json", - "dateUpdated": "2026-11-11T15:07:24.388Z" - }, - { - "cveId": "CVE-2026-125746", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125746", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125746.json", - "dateUpdated": "2026-11-11T15:06:32.648Z" - }, - { - "cveId": "CVE-2026-125763", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125763", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125763.json", - "dateUpdated": "2026-11-11T15:07:56.635Z" - }, - { - "cveId": "CVE-2026-125766", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125766", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125766.json", - "dateUpdated": "2026-11-11T15:07:05.321Z" - }, - { - "cveId": "CVE-2026-125767", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125767", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125767.json", - "dateUpdated": "2026-11-11T15:06:48.807Z" - }, - { - "cveId": "CVE-2026-125776", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125776", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125776.json", - "dateUpdated": "2026-11-11T15:09:34.839Z" - }, - { - "cveId": "CVE-2026-125778", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125778", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125778.json", - "dateUpdated": "2026-11-11T15:08:46.964Z" - }, - { - "cveId": "CVE-2026-125782", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125782", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125782.json", - "dateUpdated": "2026-11-11T15:09:51.270Z" - }, - { - "cveId": "CVE-2026-125838", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125838", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125838.json", - "dateUpdated": "2026-11-11T15:04:51.234Z" - }, - { - "cveId": "CVE-2026-125839", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125839", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125839.json", - "dateUpdated": "2026-11-11T15:05:10.463Z" - }, - { - "cveId": "CVE-2026-125840", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125840", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125840.json", - "dateUpdated": "2026-11-11T15:05:26.455Z" - }, - { - "cveId": "CVE-2026-125841", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125841", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125841.json", - "dateUpdated": "2026-11-11T15:05:44.439Z" - }, - { - "cveId": "CVE-2026-125842", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125842", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125842.json", - "dateUpdated": "2026-11-11T15:06:00.860Z" + "cveId": "CVE-2026-100290", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100290", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100290.json", + "dateUpdated": "2026-11-11T15:56:08.323Z" } ], + "updated": [], "error": [] } \ No newline at end of file diff --git a/data/deltaLog.json b/data/deltaLog.json index 5c08ceb67e..58dd55925b 100644 --- a/data/deltaLog.json +++ b/data/deltaLog.json @@ -1,4 +1,115 @@ [ + { + "fetchTime": "2026-11-11T16:01:34.892Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2026-100290", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100290", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100290.json", + "dateUpdated": "2026-11-11T15:56:08.323Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T15:55:39.317Z", + "numberOfChanges": 1, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-119618", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119618", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119618.json", + "dateUpdated": "2026-11-11T15:55:23.793Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T15:49:49.418Z", + "numberOfChanges": 2, + "new": [ + { + "cveId": "CVE-2026-64855", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-64855", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/64xxx/CVE-2026-64855.json", + "dateUpdated": "2026-11-11T15:48:16.347Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-96760", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96760", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96760.json", + "dateUpdated": "2026-11-11T15:46:59.138Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T15:38:02.168Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2026-115819", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115819", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115819.json", + "dateUpdated": "2026-11-11T15:36:38.804Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T15:30:49.733Z", + "numberOfChanges": 3, + "new": [ + { + "cveId": "CVE-2026-124686", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124686", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124686.json", + "dateUpdated": "2026-11-11T15:27:32.762Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-105440", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105440", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105440.json", + "dateUpdated": "2026-11-11T15:30:14.813Z" + }, + { + "cveId": "CVE-2026-8398", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-8398", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/8xxx/CVE-2026-8398.json", + "dateUpdated": "2026-11-11T15:28:05.468Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T15:24:44.418Z", + "numberOfChanges": 2, + "new": [ + { + "cveId": "CVE-2026-105440", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105440", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105440.json", + "dateUpdated": "2026-11-11T15:23:47.991Z" + } + ], + "updated": [ + { + "cveId": "CVE-2024-12741", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-12741", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12741.json", + "dateUpdated": "2026-11-11T15:23:56.259Z" + } + ], + "error": [] + }, { "fetchTime": "2026-11-11T15:13:17.902Z", "numberOfChanges": 42, @@ -842247,254 +842358,5 @@ ], "updated": [], "error": [] - }, - { - "fetchTime": "2026-10-12T16:00:53.793Z", - "numberOfChanges": 7, - "new": [ - { - "cveId": "CVE-2026-108906", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108906", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108906.json", - "dateUpdated": "2026-10-12T16:00:15.070Z" - }, - { - "cveId": "CVE-2026-85951", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85951", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85951.json", - "dateUpdated": "2026-10-12T15:54:35.663Z" - }, - { - "cveId": "CVE-2026-85952", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85952", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85952.json", - "dateUpdated": "2026-10-12T15:55:41.435Z" - }, - { - "cveId": "CVE-2026-85953", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85953", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85953.json", - "dateUpdated": "2026-10-12T15:58:02.995Z" - }, - { - "cveId": "CVE-2026-85954", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85954", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85954.json", - "dateUpdated": "2026-10-12T15:58:40.360Z" - }, - { - "cveId": "CVE-2026-85955", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85955", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85955.json", - "dateUpdated": "2026-10-12T15:59:28.496Z" - }, - { - "cveId": "CVE-2026-85956", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85956", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85956.json", - "dateUpdated": "2026-10-12T16:00:29.400Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T15:52:33.285Z", - "numberOfChanges": 4, - "new": [ - { - "cveId": "CVE-2026-103060", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103060", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103060.json", - "dateUpdated": "2026-10-12T15:43:57.636Z" - }, - { - "cveId": "CVE-2026-108901", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108901", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108901.json", - "dateUpdated": "2026-10-12T15:45:06.567Z" - }, - { - "cveId": "CVE-2026-81856", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-81856", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81856.json", - "dateUpdated": "2026-10-12T15:46:12.146Z" - }, - { - "cveId": "CVE-2026-85950", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85950", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85950.json", - "dateUpdated": "2026-10-12T15:42:22.190Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T15:40:12.297Z", - "numberOfChanges": 11, - "new": [ - { - "cveId": "CVE-2026-105280", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105280", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105280.json", - "dateUpdated": "2026-10-12T15:30:14.126Z" - }, - { - "cveId": "CVE-2026-105668", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105668", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105668.json", - "dateUpdated": "2026-10-12T15:31:58.926Z" - }, - { - "cveId": "CVE-2026-108900", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108900", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108900.json", - "dateUpdated": "2026-10-12T15:30:19.217Z" - }, - { - "cveId": "CVE-2026-109194", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109194", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109194.json", - "dateUpdated": "2026-10-12T15:27:03.175Z" - }, - { - "cveId": "CVE-2026-109195", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109195", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109195.json", - "dateUpdated": "2026-10-12T15:27:03.366Z" - }, - { - "cveId": "CVE-2026-85947", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85947", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85947.json", - "dateUpdated": "2026-10-12T15:34:01.239Z" - }, - { - "cveId": "CVE-2026-85948", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85948", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85948.json", - "dateUpdated": "2026-10-12T15:35:05.124Z" - }, - { - "cveId": "CVE-2026-85949", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85949", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85949.json", - "dateUpdated": "2026-10-12T15:36:31.613Z" - }, - { - "cveId": "CVE-2026-96612", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96612", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96612.json", - "dateUpdated": "2026-10-12T15:39:49.862Z" - }, - { - "cveId": "CVE-2026-96618", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96618", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96618.json", - "dateUpdated": "2026-10-12T15:29:19.117Z" - }, - { - "cveId": "CVE-2026-9191", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-9191", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9191.json", - "dateUpdated": "2026-10-12T15:32:46.475Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T15:26:57.513Z", - "numberOfChanges": 14, - "new": [ - { - "cveId": "CVE-2026-103503", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103503", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103503.json", - "dateUpdated": "2026-10-12T15:17:45.545Z" - }, - { - "cveId": "CVE-2026-107248", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107248", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107248.json", - "dateUpdated": "2026-10-12T15:06:55.302Z" - }, - { - "cveId": "CVE-2026-108899", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108899", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108899.json", - "dateUpdated": "2026-10-12T15:15:12.313Z" - }, - { - "cveId": "CVE-2026-109391", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109391", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109391.json", - "dateUpdated": "2026-10-12T15:16:39.257Z" - }, - { - "cveId": "CVE-2026-109392", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109392", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109392.json", - "dateUpdated": "2026-10-12T15:16:39.934Z" - }, - { - "cveId": "CVE-2026-109393", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109393", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109393.json", - "dateUpdated": "2026-10-12T15:16:40.590Z" - }, - { - "cveId": "CVE-2026-109394", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109394", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109394.json", - "dateUpdated": "2026-10-12T15:16:41.257Z" - }, - { - "cveId": "CVE-2026-109396", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109396", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109396.json", - "dateUpdated": "2026-10-12T15:16:41.909Z" - }, - { - "cveId": "CVE-2026-109397", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109397", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109397.json", - "dateUpdated": "2026-10-12T15:16:43.107Z" - }, - { - "cveId": "CVE-2026-109398", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109398", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109398.json", - "dateUpdated": "2026-10-12T15:16:43.793Z" - }, - { - "cveId": "CVE-2026-109399", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109399", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109399.json", - "dateUpdated": "2026-10-12T15:16:44.440Z" - }, - { - "cveId": "CVE-2026-92681", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92681", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92681.json", - "dateUpdated": "2026-10-12T15:09:49.653Z" - }, - { - "cveId": "CVE-2026-92682", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92682", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92682.json", - "dateUpdated": "2026-10-12T15:07:44.638Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-72708", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-72708", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72708.json", - "dateUpdated": "2026-10-12T15:15:48.098Z" - } - ], - "error": [] } ] \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index 5ec0f8074d..89a86f4c0f 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,7 +1,7 @@ { "source": "https://github.com/CVEProject/cvelistV5.git", - "upstream_commit": "e301dd1653f335299182b93987491ffd4e300591", + "upstream_commit": "5eea17f967f84d1b22023776d59cc6d853bb4197", "since_year": 2017, - "records": 331022, - "synced_at_utc": "2026-11-11T15:34:12.892153+00:00" + "records": 331027, + "synced_at_utc": "2026-11-11T16:33:15.330628+00:00" }