VULN/vuln-cve
1
0
Fork 0
Code Pull Requests Actions 1 Activity

CVE sync 2026-11-11T13:44:30Z

Browse Source
This commit is contained in:
Vulnerability Bot
2026-11-11 14:44:32 +01:00
parent c7b655acb7
commit c7fd3bc12e
95 changed files with 8802 additions and 709 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/2026/102xxx/CVE-2026-102010.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-28T17:33:28.667Z",
"datePublished": "2026-09-28T18:54:31.739Z",
"dateUpdated": "2026-11-11T11:59:34.243Z"
"dateUpdated": "2026-11-11T13:02:51.876Z"
},
"containers": {
"cna": {
@@ -102,6 +102,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:14.4.1-4.el10_3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -290,16 +308,6 @@
"cpe:/a:redhat:hummingbird:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
@@ -910,6 +918,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98580",
"name": "RHSA-2026:98580",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-102010",
"tags": [
@@ -967,7 +983,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:59:34.243Z"
"dateUpdated": "2026-11-11T13:02:51.876Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/102xxx/CVE-2026-102555.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-29T13:18:55.028Z",
"datePublished": "2026-09-29T17:15:14.482Z",
"dateUpdated": "2026-11-04T21:44:28.577Z"
"dateUpdated": "2026-11-11T12:48:19.549Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -142,6 +160,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-102555",
"tags": [
@@ -199,7 +225,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-04T21:44:28.577Z"
"dateUpdated": "2026-11-11T12:48:19.549Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/102xxx/CVE-2026-102556.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-29T13:19:05.617Z",
"datePublished": "2026-09-29T16:11:50.609Z",
"dateUpdated": "2026-11-11T12:16:14.716Z"
"dateUpdated": "2026-11-11T12:48:34.233Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -464,6 +482,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-102556",
"tags": [
@@ -521,7 +547,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:16:14.716Z"
"dateUpdated": "2026-11-11T12:48:34.233Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/102xxx/CVE-2026-102557.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-29T13:19:12.882Z",
"datePublished": "2026-09-29T16:11:57.871Z",
"dateUpdated": "2026-11-11T12:16:21.745Z"
"dateUpdated": "2026-11-11T12:48:44.547Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -464,6 +482,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-102557",
"tags": [
@@ -521,7 +547,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:16:21.745Z"
"dateUpdated": "2026-11-11T12:48:44.547Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/102xxx/CVE-2026-102558.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-29T13:19:17.913Z",
"datePublished": "2026-09-29T17:15:32.062Z",
"dateUpdated": "2026-11-11T12:16:27.221Z"
"dateUpdated": "2026-11-11T12:48:47.288Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -464,6 +482,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-102558",
"tags": [
@@ -521,7 +547,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:16:27.221Z"
"dateUpdated": "2026-11-11T12:48:47.288Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/102xxx/CVE-2026-102559.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-29T13:19:23.247Z",
"datePublished": "2026-09-29T17:15:34.470Z",
"dateUpdated": "2026-11-11T12:16:32.806Z"
"dateUpdated": "2026-11-11T12:48:52.825Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -464,6 +482,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-102559",
"tags": [
@@ -521,7 +547,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:16:32.806Z"
"dateUpdated": "2026-11-11T12:48:52.825Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/102xxx/CVE-2026-102560.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-29T13:19:27.962Z",
"datePublished": "2026-09-29T17:15:36.011Z",
"dateUpdated": "2026-11-11T12:16:38.381Z"
"dateUpdated": "2026-11-11T12:48:57.325Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -262,6 +280,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-102560",
"tags": [
@@ -319,7 +345,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:16:38.381Z"
"dateUpdated": "2026-11-11T12:48:57.325Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/105xxx/CVE-2026-105152.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105152",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-03T18:39:04.463Z",
"datePublished": "2026-11-11T12:38:14.723Z",
"dateUpdated": "2026-11-11T12:38:14.723Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:38:14.723Z"
},
"title": "Apache Roller: Weblog template access to wrapped objects exposes another user's password hash",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/199",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/v1zondkgmfoh3y83l0l191qthmstcm39",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "TungNQ_BMC-VNCSGlobal",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/105xxx/CVE-2026-105153.json
+135
View File
@@ -0,0 +1,135 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105153",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-03T18:40:37.633Z",
"datePublished": "2026-11-11T12:38:36.244Z",
"dateUpdated": "2026-11-11T12:38:36.244Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:38:36.244Z"
},
"title": "Apache Roller: XML external entity processing in AtomPub entry parsing",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-611: Improper Restriction of XML External Entity Reference",
"lang": "en",
"cweId": "CWE-611",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/198",
"tags": [
"patch"
]
},
{
"url": "https://github.com/apache/roller/pull/201",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/w7dsz19261myrcwx8ssbwr67hc1wfosj",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Important"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "HIGH",
"baseScore": 7.7,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "Kaya Emre Arikan",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/105xxx/CVE-2026-105154.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105154",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-03T18:40:59.594Z",
"datePublished": "2026-11-11T12:38:54.004Z",
"dateUpdated": "2026-11-11T12:38:54.004Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:38:54.004Z"
},
"title": "Apache Roller: Cross-site request forgery in Planet administration lets an attacker make the server fetch arbitrary URLs",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"cweId": "CWE-352",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a crafted web page. The action that adds a Planet subscription can be triggered cross-site; in recent releases it accepts GET requests, which Roller's CSRF token check does not cover. The action fetches the supplied URL and saves the subscription, and any fetched content that parses as a feed is then published without authentication in the aggregated Planet feed. The Planet aggregator is enabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST requests with a valid CSRF token for Planet administration changes and turns the Planet aggregator off by default.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a crafted web page. The action that adds a Planet subscription can be triggered cross-site; in recent releases it accepts GET requests, which Roller's CSRF token check does not cover. The action fetches the supplied URL and saves the subscription, and any fetched content that parses as a feed is then published without authentication in the aggregated Planet feed. The Planet aggregator is enabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST requests with a valid CSRF token for Planet administration changes and turns the Planet aggregator off by default.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/200",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/kj131jvv6y30o6q89shw6f4g4s4q5hw2",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "dacqu4n",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/108xxx/CVE-2026-108338.json
+106
View File
@@ -0,0 +1,106 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-108338",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-09T20:18:00.271Z",
"datePublished": "2026-11-11T12:39:04.163Z",
"dateUpdated": "2026-11-11T12:39:04.163Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:39:04.163Z"
},
"title": "Apache Roller: Stored cross-site scripting through AtomPub entry tags",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "5.0.1",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/208",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/xh4kv1zpdzwtpy57hgm7hy576lz758or",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "dacqu4n",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/111xxx/CVE-2026-111824.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-111824",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-16T23:32:48.939Z",
"datePublished": "2026-11-11T12:39:22.656Z",
"dateUpdated": "2026-11-11T12:39:22.656Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:39:22.656Z"
},
"title": "Apache Roller: Stored cross-site scripting through custom-theme resource URLs",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/217",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/q0lbzt39tsosb99l25gqvx24d6fn263x",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "VNCS-dacqu4n",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/114xxx/CVE-2026-114690.json
+76 -22
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-21T22:14:31.928Z",
"datePublished": "2026-10-30T07:13:04.008Z",
"dateUpdated": "2026-11-11T11:20:50.619Z"
"dateUpdated": "2026-11-11T12:38:11.959Z"
},
"containers": {
"cna": {
@@ -106,6 +106,64 @@
"cpe:/o:redhat:enterprise_linux:8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:11.5.0-17.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-16-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:16.2.1-1.4.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:11.5.0-17.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
@@ -256,16 +314,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -286,16 +334,6 @@
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-16-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -686,6 +724,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98524",
"name": "RHSA-2026:98524",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98534",
"name": "RHSA-2026:98534",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98648",
"name": "RHSA-2026:98648",
@@ -751,7 +805,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:20:50.619Z"
"dateUpdated": "2026-11-11T12:38:11.959Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/114xxx/CVE-2026-114691.json
+76 -22
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-21T22:16:10.067Z",
"datePublished": "2026-10-30T07:13:05.891Z",
"dateUpdated": "2026-11-11T11:20:51.632Z"
"dateUpdated": "2026-11-11T12:38:11.970Z"
},
"containers": {
"cna": {
@@ -106,6 +106,64 @@
"cpe:/o:redhat:enterprise_linux:8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:11.5.0-17.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-16-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:16.2.1-1.4.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:11.5.0-17.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
@@ -256,16 +314,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -286,16 +334,6 @@
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-16-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -686,6 +724,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98524",
"name": "RHSA-2026:98524",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98534",
"name": "RHSA-2026:98534",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98648",
"name": "RHSA-2026:98648",
@@ -751,7 +805,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:20:51.632Z"
"dateUpdated": "2026-11-11T12:38:11.970Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/115xxx/CVE-2026-115455.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-22T15:06:48.490Z",
"datePublished": "2026-10-30T07:13:06.547Z",
"dateUpdated": "2026-11-11T11:20:56.627Z"
"dateUpdated": "2026-11-11T12:38:16.540Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-16-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:16.2.1-1.4.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -274,16 +292,6 @@
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-16-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -344,6 +352,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98534",
"name": "RHSA-2026:98534",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98648",
"name": "RHSA-2026:98648",
@@ -406,7 +422,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:20:56.627Z"
"dateUpdated": "2026-11-11T12:38:16.540Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/115xxx/CVE-2026-115456.json
+76 -22
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-22T15:06:48.490Z",
"datePublished": "2026-10-30T08:21:50.361Z",
"dateUpdated": "2026-11-11T11:21:48.144Z"
"dateUpdated": "2026-11-11T12:38:22.898Z"
},
"containers": {
"cna": {
@@ -66,6 +66,64 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:11.5.0-17.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-16-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:16.2.1-1.4.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:11.5.0-17.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
@@ -226,16 +284,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -256,16 +304,6 @@
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-16-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -648,6 +686,22 @@
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:98524",
"name": "RHSA-2026:98524",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98534",
"name": "RHSA-2026:98534",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98648",
"name": "RHSA-2026:98648",
@@ -707,7 +761,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:21:48.144Z"
"dateUpdated": "2026-11-11T12:38:22.898Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/118xxx/CVE-2026-118405.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118405",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-28T03:32:53.812Z",
"datePublished": "2026-11-11T12:38:01.461Z",
"dateUpdated": "2026-11-11T12:38:01.461Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:38:01.461Z"
},
"title": "Apache Roller: Exposure of other users' email addresses through the user search",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/222",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/9d4nqgq2ox0g88n9gnng8dskshtp3dgo",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Low"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "hataehoon (GitHub: dpfkdlemtp)",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/118xxx/CVE-2026-118408.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118408",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-28T03:33:18.133Z",
"datePublished": "2026-11-11T12:39:37.621Z",
"dateUpdated": "2026-11-11T12:39:37.621Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:39:37.621Z"
},
"title": "Apache Roller: Unpublished entries of other weblogs readable through preview",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862: Missing Authorization",
"lang": "en",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/223",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/kzm975k5qhdpwztdmbdfwlfwsd6vopw0",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "LOW",
"baseScore": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "hataehoon (GitHub: dpfkdlemtp)",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/118xxx/CVE-2026-118409.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118409",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-28T03:33:38.671Z",
"datePublished": "2026-11-11T12:39:50.698Z",
"dateUpdated": "2026-11-11T12:39:50.698Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:39:50.698Z"
},
"title": "Apache Roller: Commenter email addresses recoverable through public search",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/225",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/nf6c1qfdclkf61s3h8p8chf4y7ztjlwd",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "hataehoon (GitHub: dpfkdlemtp)",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/118xxx/CVE-2026-118410.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118410",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-28T03:33:56.038Z",
"datePublished": "2026-11-11T12:40:00.215Z",
"dateUpdated": "2026-11-11T12:40:00.215Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:40:00.215Z"
},
"title": "Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"cweId": "CWE-668",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/226",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/oy4wv2d7sy9p9kl9nnvvfsjlgsk8bnco",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Low"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "LOW",
"baseScore": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "hataehoon (GitHub: dpfkdlemtp)",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/118xxx/CVE-2026-118411.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118411",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-28T03:34:10.012Z",
"datePublished": "2026-11-11T12:40:15.264Z",
"dateUpdated": "2026-11-11T12:40:15.264Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:40:15.264Z"
},
"title": "Apache Roller: Cross-site request forgery through GET requests to administrative actions",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"cweId": "CWE-352",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "5.0.1",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/227",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/q2h1r9v5qqofxh8qds58dtqrhf85ll60",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Important"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
}
],
"credits": [
{
"lang": "en",
"value": "hataehoon (GitHub: dpfkdlemtp)",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/118xxx/CVE-2026-118412.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118412",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-28T03:34:24.683Z",
"datePublished": "2026-11-11T12:40:29.457Z",
"dateUpdated": "2026-11-11T12:40:29.457Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:40:29.457Z"
},
"title": "Apache Roller: Disabled accounts can sign in through OpenID",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-287: Improper Authentication",
"lang": "en",
"cweId": "CWE-287",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "5.1.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/224",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/lmlcrh06ynr0tfgg2f7vwh3h9gr7b1cs",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Low"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "LOW",
"baseScore": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "hataehoon (GitHub: dpfkdlemtp)",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/118xxx/CVE-2026-118413.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118413",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-28T03:34:41.595Z",
"datePublished": "2026-11-11T12:40:47.338Z",
"dateUpdated": "2026-11-11T12:40:47.338Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:40:47.338Z"
},
"title": "Apache Roller: Stored cross-site scripting through imported blogroll links",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/221",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/y6cqvqh5sp31kr47347gmv93mj4r0bwf",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 5.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "Ivan Iushkevich (Steph)",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/118xxx/CVE-2026-118414.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118414",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-28T03:34:55.224Z",
"datePublished": "2026-11-11T12:41:00.425Z",
"dateUpdated": "2026-11-11T12:41:00.425Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:41:00.425Z"
},
"title": "Apache Roller: Stored cross-site scripting through the weblog description",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "6.1.2",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/228",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/3grnb7pwlqygxlhpxn4dz4lht4d06v28",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 5.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "DT25, VNCS_Global",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/119xxx/CVE-2026-119528.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-30T09:41:38.593Z",
"datePublished": "2026-10-30T13:52:12.118Z",
"dateUpdated": "2026-11-04T22:06:17.725Z"
"dateUpdated": "2026-11-11T12:35:24.492Z"
},
"containers": {
"cna": {
@@ -48,6 +48,24 @@
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"defaultStatus": "affected",
"versions": [
{
"version": "2:3.0.4-8.el9_9.6",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
@@ -87,19 +105,17 @@
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:98532",
"name": "RHSA-2026:98532",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-119528",
"tags": [
@@ -160,7 +176,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-04T22:06:17.725Z"
"dateUpdated": "2026-11-11T12:35:24.492Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/122xxx/CVE-2026-122096.json
+17 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-11-04T17:30:04.549Z",
"datePublished": "2026-11-11T12:13:53.275Z",
"dateUpdated": "2026-11-11T12:13:53.275Z"
"dateUpdated": "2026-11-11T13:09:23.609Z"
},
"containers": {
"cna": {
@@ -136,6 +136,21 @@
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"adp": [
{
"title": "CVE Program Container",
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/10/29"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-11-11T13:09:23.609Z"
}
}
]
}
}
data/2026/122xxx/CVE-2026-122300.json
+106
View File
@@ -0,0 +1,106 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-122300",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-11-04T22:52:24.037Z",
"datePublished": "2026-11-11T12:41:12.486Z",
"dateUpdated": "2026-11-11T12:41:12.486Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:41:12.486Z"
},
"title": "Apache Roller: Limited weblog members can remove or change published entries",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862: Missing Authorization",
"lang": "en",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.\nUsers are recommended to upgrade to Apache Roller 6.1.7 or later.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.<br>Users are recommended to upgrade to Apache Roller 6.1.7 or later."
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/235",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/s2rmc53o2rdrnq40rxomp1wdfqm3hohs",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DT25",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/123xxx/CVE-2026-123374.json
+107
View File
@@ -0,0 +1,107 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123374",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-11-05T21:50:30.293Z",
"datePublished": "2026-11-11T12:41:36.635Z",
"dateUpdated": "2026-11-11T12:41:36.635Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:41:36.635Z"
},
"title": "Apache Roller: Deserialization of untrusted data in weblog update ping responses",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"cweId": "CWE-502",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Roller",
"collectionURL": "https://github.com/apache/roller",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThanOrEqual": "6.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"value": "Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/apache/roller/pull/236",
"tags": [
"patch"
]
},
{
"url": "https://lists.apache.org/thread/577orljt8673gcvcv6nvwo2tnvykyxmt",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "Important"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "David Joudelat",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/123xxx/CVE-2026-123480.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123480",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-06T00:25:34.013Z",
"datePublished": "2026-11-11T12:41:33.649Z",
"dateUpdated": "2026-11-11T12:42:33.630Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:42:33.630Z"
},
"title": "WordPress Display Eventbrite Events plugin <= 6.9.1 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T12:41:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api allows Stored XSS.This issue affects Display Eventbrite Events: from n/a through 6.9.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api allows Stored XSS.<p>This issue affects Display Eventbrite Events: from n/a through 6.9.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "Fullworks Plugins",
"product": "Display Eventbrite Events",
"packageName": "widget-for-eventbrite-api",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "6.9.1",
"changes": [
{
"at": "6.9.2",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/widget-for-eventbrite-api/vulnerability/wordpress-display-eventbrite-events-plugin-6-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Oly Hossen | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Display Eventbrite Events plugin to the latest available version (at least 6.9.2).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Display Eventbrite Events plugin to the latest available version (at least 6.9.2)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/123xxx/CVE-2026-123481.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123481",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-06T00:25:34.013Z",
"datePublished": "2026-11-11T12:40:46.952Z",
"dateUpdated": "2026-11-11T12:41:46.288Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:41:46.288Z"
},
"title": "WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T12:40:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "WP Extended",
"product": "The Ultimate WordPress Toolkit – WP Extended",
"packageName": "wpextended",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.4.2",
"changes": [
{
"at": "3.4.3",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wpextended/vulnerability/wordpress-the-ultimate-wordpress-toolkit-wp-extended-plugin-3-4-2-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Mnzn | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress The Ultimate WordPress Toolkit – WP Extended plugin to the latest available version (at least 3.4.3).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress The Ultimate WordPress Toolkit – WP Extended plugin to the latest available version (at least 3.4.3)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124261.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124261",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-11T12:37:06.142Z",
"dateUpdated": "2026-11-11T12:38:08.129Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:38:08.129Z"
},
"title": "WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.7 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T12:36:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.7.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.7.</p>"
}
]
}
],
"affected": [
{
"vendor": "Magepeople inc.",
"product": "Taxi Booking Manager for WooCommerce",
"packageName": "ecab-taxi-booking-manager",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.1.7",
"changes": [
{
"at": "2.2.9",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocommerce-plugin-2-1-7-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "ashv4ni | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Taxi Booking Manager for WooCommerce plugin to the latest available version (at least 2.2.9).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Taxi Booking Manager for WooCommerce plugin to the latest available version (at least 2.2.9)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124263.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124263",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-11T12:38:14.639Z",
"dateUpdated": "2026-11-11T12:39:14.967Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:39:14.967Z"
},
"title": "WordPress Locatoraid Store Locator plugin <= 3.9.75 - Cross Site Request Forgery (CSRF) vulnerability",
"datePublic": "2026-11-11T12:38:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Forgery.This issue affects Locatoraid Store Locator: from n/a through 3.9.75.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Forgery.<p>This issue affects Locatoraid Store Locator: from n/a through 3.9.75.</p>"
}
]
}
],
"affected": [
{
"vendor": "plainware",
"product": "Locatoraid Store Locator",
"packageName": "locatoraid",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.9.75",
"changes": [
{
"at": "3.9.76",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/locatoraid/vulnerability/wordpress-locatoraid-store-locator-plugin-3-9-75-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "peppa | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Request Forgery"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Locatoraid Store Locator plugin to the latest available version (at least 3.9.76).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Locatoraid Store Locator plugin to the latest available version (at least 3.9.76)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124416.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124416",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-11T12:38:52.064Z",
"dateUpdated": "2026-11-11T12:39:52.258Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:39:52.258Z"
},
"title": "WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T12:38:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects WP Job Portal: from n/a through 2.7.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "Ahmad",
"product": "WP Job Portal",
"packageName": "wp-job-portal",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.7.2",
"changes": [
{
"at": "2.8.0",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-7-2-broken-access-control-vulnerability-4?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Phuong Nguyen | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress WP Job Portal plugin to the latest available version (at least 2.8.0).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress WP Job Portal plugin to the latest available version (at least 2.8.0)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124495.json
+103
View File
@@ -0,0 +1,103 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124495",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-11-08T05:21:06.195Z",
"datePublished": "2026-11-11T12:34:51.298Z",
"dateUpdated": "2026-11-11T12:34:51.298Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:34:51.298Z"
},
"title": "Apache Storm: Logviewer follows worker symlinks across topology ACLs",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')",
"lang": "en",
"cweId": "CWE-59",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Storm",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.storm:storm-webapp",
"packageURL": "pkg:maven/org.apache.storm/storm-webapp",
"versions": [
{
"status": "affected",
"version": "3.0.0",
"lessThan": "3.2.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"value": "When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue."
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread/q4xbld4n4v14t8d74vb342skx8d0mzz8",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "low"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Javier García Herrera",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/124xxx/CVE-2026-124496.json
+103
View File
@@ -0,0 +1,103 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124496",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-11-08T05:21:23.284Z",
"datePublished": "2026-11-11T12:35:22.344Z",
"dateUpdated": "2026-11-11T12:35:22.344Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:35:22.344Z"
},
"title": "Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Storm",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.storm:storm-server",
"packageURL": "pkg:maven/org.apache.storm/storm-server",
"versions": [
{
"status": "affected",
"version": "3.0.0",
"lessThan": "3.2.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"value": "The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue."
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "low"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Javier García Herrera",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/124xxx/CVE-2026-124744.json
+137
View File
@@ -0,0 +1,137 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124744",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.479Z",
"datePublished": "2026-11-11T12:29:17.756Z",
"dateUpdated": "2026-11-11T12:29:17.756Z"
},
"containers": {
"cna": {
"title": "Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection",
"metrics": [
{
"other": {
"content": {
"value": "Moderate",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "busybox",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "busybox",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-124744",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571625",
"name": "RHBZ#2571625",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-11T09:15:15.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T13:40:21.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-11T09:15:15.000Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:29:17.756Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/124xxx/CVE-2026-124745.json
+137
View File
@@ -0,0 +1,137 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124745",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.479Z",
"datePublished": "2026-11-11T12:29:18.382Z",
"dateUpdated": "2026-11-11T12:29:18.382Z"
},
"containers": {
"cna": {
"title": "Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory",
"metrics": [
{
"other": {
"content": {
"value": "Moderate",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "busybox",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "busybox",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-124745",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571637",
"name": "RHBZ#2571637",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-11T09:15:15.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T13:40:37.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-11T09:15:15.000Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:29:18.382Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/125xxx/CVE-2026-125045.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125045",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T16:21:06.462Z",
"datePublished": "2026-11-11T12:34:30.029Z",
"dateUpdated": "2026-11-11T12:35:31.243Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:35:31.243Z"
},
"title": "WordPress Create plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T12:34:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.This issue affects Create: from n/a through 3.1.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.<p>This issue affects Create: from n/a through 3.1.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "John-Michael L'Allier",
"product": "Create",
"packageName": "mediavine-create",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.1.1",
"changes": [
{
"at": "3.1.2",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/mediavine-create/vulnerability/wordpress-create-plugin-3-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Gabriel Igor | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Create plugin to the latest available version (at least 3.1.2).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Create plugin to the latest available version (at least 3.1.2)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125046.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125046",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T16:21:10.516Z",
"datePublished": "2026-11-11T13:02:24.506Z",
"dateUpdated": "2026-11-11T13:02:44.252Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T13:02:44.252Z"
},
"title": "WordPress Create plugin <= 3.1.1 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T13:02:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Create: from n/a through 3.1.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "John-Michael L'Allier",
"product": "Create",
"packageName": "mediavine-create",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.1.1",
"changes": [
{
"at": "3.1.2",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/mediavine-create/vulnerability/wordpress-create-plugin-3-1-1-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Malvin Valerian Gultom | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Create plugin to the latest available version (at least 3.1.2).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Create plugin to the latest available version (at least 3.1.2)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125431.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125431",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.520Z",
"datePublished": "2026-11-11T12:37:36.519Z",
"dateUpdated": "2026-11-11T12:37:38.047Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:37:38.047Z"
},
"title": "WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.7 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T12:37:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7.</p>"
}
]
}
],
"affected": [
{
"vendor": "Mamunur Rashid",
"product": "Food Menu – Restaurant Menu & Online Ordering for WooCommerce",
"packageName": "tlp-food-menu",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "6.0.7",
"changes": [
{
"at": "6.0.8",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/tlp-food-menu/vulnerability/wordpress-food-menu-restaurant-menu-online-ordering-for-woocommerce-plugin-6-0-7-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Riki | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin to the latest available version (at least 6.0.8).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin to the latest available version (at least 6.0.8)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125433.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125433",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.520Z",
"datePublished": "2026-11-11T12:39:14.195Z",
"dateUpdated": "2026-11-11T12:39:15.528Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:39:15.528Z"
},
"title": "WordPress Futurio Extra plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T12:39:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through 2.0.25.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.<p>This issue affects Futurio Extra: from n/a through 2.0.25.</p>"
}
]
}
],
"affected": [
{
"vendor": "FuturioWP",
"product": "Futurio Extra",
"packageName": "futurio-extra",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.0.25",
"changes": [
{
"at": "2.0.26",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/futurio-extra/vulnerability/wordpress-futurio-extra-plugin-2-0-25-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Peter Tang | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Futurio Extra plugin to the latest available version (at least 2.0.26).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Futurio Extra plugin to the latest available version (at least 2.0.26)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125436.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125436",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.521Z",
"datePublished": "2026-11-11T12:39:38.057Z",
"dateUpdated": "2026-11-11T12:40:37.418Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:40:37.418Z"
},
"title": "WordPress The Post Grid plugin <= 7.9.9 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T12:39:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Post Grid: from n/a through 7.9.9.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects The Post Grid: from n/a through 7.9.9.</p>"
}
]
}
],
"affected": [
{
"vendor": "Mamunur Rashid",
"product": "The Post Grid",
"packageName": "the-post-grid",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "7.9.9",
"changes": [
{
"at": "7.9.10",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/the-post-grid/vulnerability/wordpress-the-post-grid-plugin-7-9-9-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Kim Taehyeon (taehyeon-git) | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress The Post Grid plugin to the latest available version (at least 7.9.10).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress The Post Grid plugin to the latest available version (at least 7.9.10)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125448.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125448",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.522Z",
"datePublished": "2026-11-11T12:41:11.637Z",
"dateUpdated": "2026-11-11T12:42:13.229Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:42:13.229Z"
},
"title": "WordPress Kali Forms plugin <= 2.4.31 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T12:40:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.31.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Kali Forms: from n/a through 2.4.31.</p>"
}
]
}
],
"affected": [
{
"vendor": "Kaliforms",
"product": "Kali Forms",
"packageName": "kali-forms",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.4.31",
"changes": [
{
"at": "2.4.32",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-kali-forms-plugin-2-4-31-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Ayushmaan Sharma | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Kali Forms plugin to the latest available version (at least 2.4.32).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Kali Forms plugin to the latest available version (at least 2.4.32)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125450.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125450",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.522Z",
"datePublished": "2026-11-11T12:35:19.626Z",
"dateUpdated": "2026-11-11T12:35:19.626Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:35:19.626Z"
},
"title": "WordPress SureRank plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T12:35:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank allows Stored XSS.This issue affects SureRank: from n/a through 1.10.3.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank allows Stored XSS.<p>This issue affects SureRank: from n/a through 1.10.3.</p>"
}
]
}
],
"affected": [
{
"vendor": "Brainstorm Force",
"product": "SureRank",
"packageName": "surerank",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.10.3",
"changes": [
{
"at": "1.11.0",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/surerank/vulnerability/wordpress-surerank-plugin-1-10-3-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Filip Kowalski | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress SureRank plugin to the latest available version (at least 1.11.0).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress SureRank plugin to the latest available version (at least 1.11.0)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125454.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125454",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.522Z",
"datePublished": "2026-11-11T12:59:38.477Z",
"dateUpdated": "2026-11-11T13:00:40.199Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T13:00:40.199Z"
},
"title": "WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T12:59:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.<p>This issue affects Passster: from n/a through 4.3.21.</p>"
}
]
}
],
"affected": [
{
"vendor": "WP Chill",
"product": "Passster",
"packageName": "content-protector",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.3.21",
"changes": [
{
"at": "4.3.22",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/content-protector/vulnerability/wordpress-passster-plugin-4-3-21-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "dzaku | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Passster plugin to the latest available version (at least 4.3.22).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Passster plugin to the latest available version (at least 4.3.22)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125708.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125708",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T10:33:19.136Z",
"datePublished": "2026-11-11T13:01:17.688Z",
"dateUpdated": "2026-11-11T13:02:23.291Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T13:02:23.291Z"
},
"title": "WordPress Element Pack Elementor Addons plugin <= 10.0.4 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.4.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.<p>This issue affects Element Pack Elementor Addons: from n/a through 10.0.4.</p>"
}
]
}
],
"affected": [
{
"vendor": "BdThemes",
"product": "Element Pack Elementor Addons",
"packageName": "bdthemes-element-pack-lite",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "10.0.4",
"changes": [
{
"at": "10.0.5",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-10-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "nh4tvd | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Element Pack Elementor Addons plugin to the latest available version (at least 10.0.5).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Element Pack Elementor Addons plugin to the latest available version (at least 10.0.5)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125743.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125743",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:11:45.564Z",
"datePublished": "2026-11-11T12:40:02.640Z",
"dateUpdated": "2026-11-11T12:40:03.278Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:40:03.278Z"
},
"title": "WordPress Elementor Addon Elements plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T12:39:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.5.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.<p>This issue affects Elementor Addon Elements: from n/a through 1.5.</p>"
}
]
}
],
"affected": [
{
"vendor": "WPVibes",
"product": "Elementor Addon Elements",
"packageName": "addon-elements-for-elementor-page-builder",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.5",
"changes": [
{
"at": "1.5.1",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/addon-elements-for-elementor-page-builder/vulnerability/wordpress-elementor-addon-elements-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "nh4tvd | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Elementor Addon Elements plugin to the latest available version (at least 1.5.1).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Elementor Addon Elements plugin to the latest available version (at least 1.5.1)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125746.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125746",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:29:24.878Z",
"datePublished": "2026-11-11T13:00:40.487Z",
"dateUpdated": "2026-11-11T13:01:42.976Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T13:01:42.976Z"
},
"title": "WordPress Back In Stock Notifier for WooCommerce plugin <= 7.5.2 - Content Injection vulnerability",
"datePublic": "2026-11-11T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.<p>This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "ProPluginsLab",
"product": "Back In Stock Notifier for WooCommerce",
"packageName": "back-in-stock-notifier-for-woocommerce",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "7.5.2",
"changes": [
{
"at": "7.5.3",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/back-in-stock-notifier-for-woocommerce/vulnerability/wordpress-back-in-stock-notifier-for-woocommerce-plugin-7-5-2-content-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Askar | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Back In Stock Notifier for WooCommerce plugin to the latest available version (at least 7.5.3).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Back In Stock Notifier for WooCommerce plugin to the latest available version (at least 7.5.3)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125762.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125762",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.981Z",
"datePublished": "2026-11-11T12:34:54.965Z",
"dateUpdated": "2026-11-11T12:35:55.754Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:35:55.754Z"
},
"title": "WordPress Premium Addons for Elementor plugin <= 4.11.116 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T12:34:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.116.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.<p>This issue affects Premium Addons for Elementor: from n/a through 4.11.116.</p>"
}
]
}
],
"affected": [
{
"vendor": "LeapWorx",
"product": "Premium Addons for Elementor",
"packageName": "premium-addons-for-elementor",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.11.116",
"changes": [
{
"at": "4.11.117",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-116-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Khanh Nguyen | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.11.117).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.11.117)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125763.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125763",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.981Z",
"datePublished": "2026-11-11T12:40:25.056Z",
"dateUpdated": "2026-11-11T12:41:27.183Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:41:27.183Z"
},
"title": "WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T12:40:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects SureForms: from n/a through 2.13.0.</p>"
}
]
}
],
"affected": [
{
"vendor": "Brainstorm Force",
"product": "SureForms",
"packageName": "sureforms",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.13.0",
"changes": [
{
"at": "2.13.1",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/sureforms/vulnerability/wordpress-sureforms-plugin-2-13-0-broken-access-control-vulnerability-2?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Truebird | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress SureForms plugin to the latest available version (at least 2.13.1).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress SureForms plugin to the latest available version (at least 2.13.1)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125766.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125766",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.982Z",
"datePublished": "2026-11-11T12:42:38.734Z",
"dateUpdated": "2026-11-11T12:52:52.747Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:52:52.747Z"
},
"title": "WordPress WPZOOM Social Feed Widget & Block plugin <= 2.4.1 - Sensitive Data Exposure vulnerability",
"datePublic": "2026-11-11T12:42:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.<p>This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "WPZOOM",
"product": "WPZOOM Social Feed Widget & Block",
"packageName": "instagram-widget-by-wpzoom",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.4.1",
"changes": [
{
"at": "2.4.2",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/instagram-widget-by-wpzoom/vulnerability/wordpress-wpzoom-social-feed-widget-block-plugin-2-4-1-sensitive-data-exposure-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Ankesh Singh | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "Retrieve Embedded Sensitive Data"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress WPZOOM Social Feed Widget & Block plugin to the latest available version (at least 2.4.2).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress WPZOOM Social Feed Widget & Block plugin to the latest available version (at least 2.4.2)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125767.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125767",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.982Z",
"datePublished": "2026-11-11T12:53:23.741Z",
"dateUpdated": "2026-11-11T12:54:24.794Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:54:24.794Z"
},
"title": "WordPress Hubbub Lite plugin <= 1.36.3.1 - Sensitive Data Exposure vulnerability",
"datePublic": "2026-11-11T12:53:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.<p>This issue affects Hubbub Lite: from n/a through 1.36.3.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "NerdPress",
"product": "Hubbub Lite",
"packageName": "social-pug",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.36.3.1",
"changes": [
{
"at": "1.36.3.2",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/social-pug/vulnerability/wordpress-hubbub-lite-plugin-1-36-3-1-sensitive-data-exposure-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Malvin Valerian Gultom | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "Retrieve Embedded Sensitive Data"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Hubbub Lite plugin to the latest available version (at least 1.36.3.2).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Hubbub Lite plugin to the latest available version (at least 1.36.3.2)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125776.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125776",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.983Z",
"datePublished": "2026-11-11T12:36:04.025Z",
"dateUpdated": "2026-11-11T12:36:32.411Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:36:32.411Z"
},
"title": "WordPress Profile Builder plugin <= 4.0.6 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T12:35:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Profile Builder: from n/a through 4.0.6.</p>"
}
]
}
],
"affected": [
{
"vendor": "Cozmoslabs",
"product": "Profile Builder",
"packageName": "profile-builder",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.0.6",
"changes": [
{
"at": "4.0.7",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/profile-builder/vulnerability/wordpress-profile-builder-plugin-4-0-6-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Malvin Valerian Gultom | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Profile Builder plugin to the latest available version (at least 4.0.7).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Profile Builder plugin to the latest available version (at least 4.0.7)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125778.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125778",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.983Z",
"datePublished": "2026-11-11T12:38:33.446Z",
"dateUpdated": "2026-11-11T12:39:34.805Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T12:39:34.805Z"
},
"title": "WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability",
"datePublic": "2026-11-11T12:38:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.<p>This issue affects myCred: from n/a through 4.0.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "myCred",
"product": "myCred",
"packageName": "mycred",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.0.2",
"changes": [
{
"at": "4.0.3",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-content-injection-vulnerability-2?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "neurotx | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.3).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.3)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125850.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125850",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-11T13:16:11.697Z",
"dateUpdated": "2026-11-11T13:16:12.172Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-11T13:16:12.172Z"
},
"title": "WordPress Appointment Dark theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability",
"datePublic": "2026-11-11T13:15:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.This issue affects Appointment Dark: from n/a through 1.3.4.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.<p>This issue affects Appointment Dark: from n/a through 1.3.4.</p>"
}
]
}
],
"affected": [
{
"vendor": "webriti",
"product": "Appointment Dark",
"packageName": "appointment-dark",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.3.4"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/appointment-dark/vulnerability/wordpress-appointment-dark-theme-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "beopseong.kim | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Request Forgery"
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/126xxx/CVE-2026-126537.json
+93
View File
@@ -0,0 +1,93 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126537",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-10T23:59:47.100Z",
"datePublished": "2026-11-11T12:34:45.417Z",
"dateUpdated": "2026-11-11T12:34:45.417Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-11T12:34:45.417Z"
},
"affected": [
{
"vendor": "SaturdayDrive",
"product": "Ninja Forms - File Uploads",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "3.3.36",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php — which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress — and NF_FU_External_Abstracts_Service::process_upload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends upload_id. By omitting upload_id, an attacker's data[file_path] survives into the Background Upload queue and is used by both upload_file_to_s3() (as SourceFile) and the maybe_delete_server_file() unlink() call in includes/external/abstracts/backgroundupload.php, with no canonicalization or upload-directory containment check (the plugin's own is_path_within_upload_dir() helper is only applied on admin paths). This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible — specifically, deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover."
}
],
"title": "Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3670e2aa-6d8e-4ba5-ab65-49bd2a3dcacc?source=cve"
},
{
"url": "https://ninjaforms.com/extensions/file-uploads/"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daroo"
}
],
"timeline": [
{
"time": "2026-10-13T17:48:47.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-11T00:01:15.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/126xxx/CVE-2026-126658.json
+153
View File
@@ -0,0 +1,153 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126658",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T11:58:21.462Z",
"datePublished": "2026-11-11T12:24:35.975Z",
"dateUpdated": "2026-11-11T12:24:35.975Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T12:24:35.975Z"
},
"datePublic": "2026-11-10T11:33:37.000Z",
"title": "ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys",
"descriptions": [
{
"lang": "en",
"value": "ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Insufficient Session Expiration",
"cweId": "CWE-613",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "jordan-dalby",
"product": "ByteStash",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.5.10",
"lessThan": "1.6.2",
"status": "affected",
"versionType": "semver"
},
{
"version": "1.6.2",
"status": "unaffected",
"versionType": "semver"
}
],
"packageURL": "pkg:github/jordan-dalby/ByteStash",
"repo": "https://github.com/jordan-dalby/ByteStash"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-26m9-ww2j-3cr5)"
},
{
"url": "https://github.com/jordan-dalby/ByteStash/commit/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b",
"tags": [
"patch"
]
},
{
"url": "https://github.com/jordan-dalby/ByteStash/releases/tag/v1.6.2",
"tags": [
"release-notes"
],
"name": "ByteStash v1.6.2 Release Notes"
},
{
"url": "https://github.com/jordan-dalby/ByteStash/blob/v1.6.1/server/src/repositories/apiKeyRepository.js#L70-L78",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bytestash-1.5.10-before-1.6.2-insufficient-session-expiration-via-api-keys"
}
],
"credits": [
{
"lang": "en",
"value": "Adib Farhan",
"type": "finder"
},
{
"lang": "en",
"value": "Jordan Dalby",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126659.json
+160
View File
@@ -0,0 +1,160 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126659",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T11:58:26.643Z",
"datePublished": "2026-11-11T12:24:36.624Z",
"dateUpdated": "2026-11-11T12:24:36.624Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T12:24:36.624Z"
},
"datePublic": "2026-11-10T17:59:24.000Z",
"title": "BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 Storage Exhaustion via Anonymous Blueprints",
"descriptions": [
{
"lang": "en",
"value": "BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Allocation of Resources Without Limits or Throttling",
"cweId": "CWE-770",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "blueprintue",
"product": "blueprintue-self-hosted-edition",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0.0",
"lessThan": "4.3.5",
"status": "affected",
"versionType": "semver"
},
{
"version": "4.3.5",
"status": "unaffected",
"versionType": "semver"
}
],
"packageURL": "pkg:github/blueprintue/blueprintue-self-hosted-edition",
"repo": "https://github.com/blueprintue/blueprintue-self-hosted-edition"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-q2vm-p36g-w596",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-q2vm-p36g-w596)"
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/0709b39851bf58febccf0bc74b88fa86070410de",
"tags": [
"patch"
]
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/268",
"tags": [
"patch",
"issue-tracking"
]
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.5",
"tags": [
"release-notes"
],
"name": "blueprintue-self-hosted-edition v4.3.5 Release Notes"
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.4/app/controllers/www/HomeController.php#L151-L214",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 Storage Exhaustion via Anonymous Blueprints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-1.0.0-before-4.3.5-storage-exhaustion-via-anonymous-blueprints"
}
],
"credits": [
{
"lang": "en",
"value": "Farhan Khan",
"type": "finder"
},
{
"lang": "en",
"value": "rancoud",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126662.json
+216
View File
@@ -0,0 +1,216 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126662",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T12:03:56.584Z",
"datePublished": "2026-11-11T12:24:37.304Z",
"dateUpdated": "2026-11-11T12:24:37.304Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T12:24:37.304Z"
},
"datePublic": "2026-11-11T07:15:05.000Z",
"title": "Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple",
"descriptions": [
{
"lang": "en",
"value": "Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Missing Authorization",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Contao",
"product": "Contao",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.0.0",
"lessThan": "5.3.54",
"status": "affected",
"versionType": "semver"
},
{
"version": "5.4.0-RC1",
"lessThan": "5.7.17",
"status": "affected",
"versionType": "semver"
},
{
"version": "6.0.0-RC1",
"lessThan": "6.0.6",
"status": "affected",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/contao/core-bundle",
"repo": "https://github.com/contao/contao"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "5.3.54"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.0-rc1",
"versionEndExcluding": "5.7.17"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0-rc1",
"versionEndExcluding": "6.0.6"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-9jfh-v443-w3fj)"
},
{
"url": "https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900",
"tags": [
"patch"
]
},
{
"url": "https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66",
"tags": [
"patch"
]
},
{
"url": "https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70",
"tags": [
"patch"
]
},
{
"url": "https://github.com/contao/contao/releases/tag/5.3.54",
"tags": [
"release-notes"
],
"name": "Contao 5.3.54 Release Notes"
},
{
"url": "https://github.com/contao/contao/releases/tag/5.7.17",
"tags": [
"release-notes"
],
"name": "Contao 5.7.17 Release Notes"
},
{
"url": "https://github.com/contao/contao/releases/tag/6.0.6",
"tags": [
"release-notes"
],
"name": "Contao 6.0.6 Release Notes"
},
{
"url": "https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple"
}
],
"credits": [
{
"lang": "en",
"value": "AlpetGexha",
"type": "finder"
},
{
"lang": "en",
"value": "ausi",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126663.json
+216
View File
@@ -0,0 +1,216 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126663",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T12:04:02.005Z",
"datePublished": "2026-11-11T12:24:38.010Z",
"dateUpdated": "2026-11-11T12:24:38.010Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T12:24:38.010Z"
},
"datePublic": "2026-11-11T07:13:13.000Z",
"title": "Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag",
"descriptions": [
{
"lang": "en",
"value": "Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect Behavior Order: Validate Before Canonicalize",
"cweId": "CWE-180",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Contao",
"product": "Contao",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.0.0",
"lessThan": "5.3.54",
"status": "affected",
"versionType": "semver"
},
{
"version": "5.4.0-RC1",
"lessThan": "5.7.17",
"status": "affected",
"versionType": "semver"
},
{
"version": "6.0.0-RC1",
"lessThan": "6.0.6",
"status": "affected",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/contao/core-bundle",
"repo": "https://github.com/contao/contao"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "5.3.54"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.0-rc1",
"versionEndExcluding": "5.7.17"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0-rc1",
"versionEndExcluding": "6.0.6"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-r7cf-mfp4-r23h)"
},
{
"url": "https://github.com/contao/contao/commit/688c0f6213afbd000cd22ad0a44555eca80b40ab",
"tags": [
"patch"
]
},
{
"url": "https://github.com/contao/contao/commit/0f7989eb5b28d85dcd441ef22f80f8af4f56433e",
"tags": [
"patch"
]
},
{
"url": "https://github.com/contao/contao/commit/e820e3c9d79a5c07f274558513c8db08a79bf804",
"tags": [
"patch"
]
},
{
"url": "https://github.com/contao/contao/releases/tag/5.3.54",
"tags": [
"release-notes"
],
"name": "Contao 5.3.54 Release Notes"
},
{
"url": "https://github.com/contao/contao/releases/tag/5.7.17",
"tags": [
"release-notes"
],
"name": "Contao 5.7.17 Release Notes"
},
{
"url": "https://github.com/contao/contao/releases/tag/6.0.6",
"tags": [
"release-notes"
],
"name": "Contao 6.0.6 Release Notes"
},
{
"url": "https://github.com/contao/contao/blob/5.3.53/core-bundle/src/InsertTag/Resolver/LegacyInsertTag.php#L565-L582",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-path-traversal-via-image-insert-tag"
}
],
"credits": [
{
"lang": "en",
"value": "AlpetGexha",
"type": "finder"
},
{
"lang": "en",
"value": "ausi",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/15xxx/CVE-2026-15709.json
+54 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-07-14T09:32:47.038Z",
"datePublished": "2026-07-14T19:41:37.331Z",
"dateUpdated": "2026-11-05T16:42:46.403Z"
"dateUpdated": "2026-11-11T12:57:51.595Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -228,6 +246,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.72.0-17.el9_9.6",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -386,6 +422,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98453",
"name": "RHSA-2026:98453",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-15709",
"tags": [
@@ -446,7 +498,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T16:42:46.403Z"
"dateUpdated": "2026-11-11T12:57:51.595Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/15xxx/CVE-2026-15711.json
+54 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-07-14T09:45:31.488Z",
"datePublished": "2026-07-14T19:45:47.784Z",
"dateUpdated": "2026-11-05T16:42:48.790Z"
"dateUpdated": "2026-11-11T12:57:51.673Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -266,6 +284,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.72.0-17.el9_9.6",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -422,6 +458,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98453",
"name": "RHSA-2026:98453",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-15711",
"tags": [
@@ -482,7 +534,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T16:42:48.790Z"
"dateUpdated": "2026-11-11T12:57:51.673Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/16xxx/CVE-2026-16118.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-07-17T15:50:21.345Z",
"datePublished": "2026-07-17T19:44:40.562Z",
"dateUpdated": "2026-11-11T12:19:36.217Z"
"dateUpdated": "2026-11-11T12:58:11.638Z"
},
"containers": {
"cna": {
@@ -73,6 +73,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glib2",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.80.4-22.el10_3.23",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -2322,6 +2340,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98557",
"name": "RHSA-2026:98557",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-16118",
"tags": [
@@ -2382,7 +2408,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:19:36.217Z"
"dateUpdated": "2026-11-11T12:58:11.638Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/16xxx/CVE-2026-16313.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-07-20T15:35:41.936Z",
"datePublished": "2026-07-28T16:47:06.471Z",
"dateUpdated": "2026-11-11T05:50:04.038Z"
"dateUpdated": "2026-11-11T12:40:47.775Z"
},
"containers": {
"cna": {
@@ -363,6 +363,24 @@
"cpe:/a:redhat:openshift:4.14::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.15",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"defaultStatus": "affected",
"versions": [
{
"version": "415.92.202611051005-0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
@@ -679,6 +697,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:95755",
"name": "RHSA-2026:95755",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-16313",
"tags": [
@@ -739,7 +765,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T05:50:04.038Z"
"dateUpdated": "2026-11-11T12:40:47.775Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/40xxx/CVE-2026-40853.json
+99
View File
@@ -0,0 +1,99 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40853",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-04-15T09:36:04.823Z",
"datePublished": "2026-11-11T13:16:13.608Z",
"dateUpdated": "2026-11-11T13:16:13.608Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T13:16:13.608Z"
},
"title": "Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
"lang": "en",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"source": {
"defect": [
"BATIK-1392"
],
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache XML Graphics Batik",
"packageURL": "pkg:maven/org.apache.xmlgraphics/batik-svggen",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "1.19.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.xmlgraphics:batik-svggen"
}
],
"descriptions": [
{
"value": "A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>A&nbsp;Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont.</p><p>This issue affects Apache XML Graphics Batik: through 1.19.</p><p>Users are recommended to upgrade to version 1.20, which fixes the issue.</p>"
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread.html/donct9w5lp5rlvl1p7m8cfx380d2wy4c",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/42xxx/CVE-2026-42011.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-04-23T11:23:46.517Z",
"datePublished": "2026-05-07T13:51:04.695Z",
"dateUpdated": "2026-11-11T06:18:22.000Z"
"dateUpdated": "2026-11-11T12:41:31.479Z"
},
"containers": {
"cna": {
@@ -551,6 +551,24 @@
"cpe:/a:redhat:openshift:4.14::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.15",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"defaultStatus": "affected",
"versions": [
{
"version": "415.92.202611051005-0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
@@ -1359,6 +1377,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:95755",
"name": "RHSA-2026:95755",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42011",
"tags": [
@@ -1413,7 +1439,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T06:18:22.000Z"
"dateUpdated": "2026-11-11T12:41:31.479Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/42xxx/CVE-2026-42013.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-04-23T11:23:46.517Z",
"datePublished": "2026-05-26T21:29:32.887Z",
"dateUpdated": "2026-11-11T06:18:24.426Z"
"dateUpdated": "2026-11-11T12:41:33.254Z"
},
"containers": {
"cna": {
@@ -551,6 +551,24 @@
"cpe:/a:redhat:openshift:4.14::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.15",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"defaultStatus": "affected",
"versions": [
{
"version": "415.92.202611051005-0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
@@ -1359,6 +1377,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:95755",
"name": "RHSA-2026:95755",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42013",
"tags": [
@@ -1419,7 +1445,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T06:18:24.426Z"
"dateUpdated": "2026-11-11T12:41:33.254Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/48xxx/CVE-2026-48479.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-48479",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2026-05-21T15:29:43.910Z",
"datePublished": "2026-11-11T13:18:49.334Z",
"dateUpdated": "2026-11-11T13:18:49.334Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-11T13:18:49.334Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded R1000 Series Processors",
"versions": [
{
"version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded R2000 Series Processors",
"versions": [
{
"version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")",
"versions": [
{
"version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V2000 Series Processors",
"versions": [
{
"version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Picasso\")",
"versions": [
{
"version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-11T13:17:38.237Z",
"descriptions": [
{
"lang": "en",
"value": "Use of uninitialized or invalid state in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of uninitialized or invalid state in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4026.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2026/76xxx/CVE-2026-76235.json
+48 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-08-19T11:37:44.676Z",
"datePublished": "2026-08-19T12:44:55.680Z",
"dateUpdated": "2026-11-09T16:36:26.710Z"
"dateUpdated": "2026-11-11T13:11:49.966Z"
},
"containers": {
"cna": {
@@ -103,6 +103,25 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -122,6 +141,25 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
@@ -188,6 +226,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98463",
"name": "RHSA-2026:98463",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-76235",
"tags": [
@@ -245,7 +291,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-09T16:36:26.710Z"
"dateUpdated": "2026-11-11T13:11:49.966Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/78xxx/CVE-2026-78002.json
+54 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-08-21T19:35:37.617Z",
"datePublished": "2026-08-27T16:12:59.102Z",
"dateUpdated": "2026-11-09T02:53:03.131Z"
"dateUpdated": "2026-11-11T12:49:02.652Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rsyslog",
"defaultStatus": "affected",
"versions": [
{
"version": "0:8.2604.0-5.el10_3.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -252,6 +270,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rsyslog",
"defaultStatus": "affected",
"versions": [
{
"version": "0:8.2604.0-4.el9_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -442,6 +478,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98456",
"name": "RHSA-2026:98456",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98558",
"name": "RHSA-2026:98558",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78002",
"tags": [
@@ -496,7 +548,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-09T02:53:03.131Z"
"dateUpdated": "2026-11-11T12:49:02.652Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/79xxx/CVE-2026-79992.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-08-25T16:39:44.534Z",
"datePublished": "2026-08-25T17:16:28.309Z",
"dateUpdated": "2026-11-04T23:41:03.057Z"
"dateUpdated": "2026-11-11T12:53:50.949Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "emacs",
"defaultStatus": "affected",
"versions": [
{
"version": "1:29.4-17.el10_3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -168,6 +186,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98574",
"name": "RHSA-2026:98574",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-79992",
"tags": [
@@ -219,7 +245,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-04T23:41:03.057Z"
"dateUpdated": "2026-11-11T12:53:50.949Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/84xxx/CVE-2026-84042.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-01T03:55:17.620Z",
"datePublished": "2026-09-10T08:24:50.971Z",
"dateUpdated": "2026-11-10T15:18:37.485Z"
"dateUpdated": "2026-11-11T12:52:51.999Z"
},
"containers": {
"cna": {
@@ -48,6 +48,24 @@
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "crun",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.30.1-1.el10_3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -66,16 +84,6 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "crun",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -146,6 +154,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98561",
"name": "RHSA-2026:98561",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-84042",
"tags": [
@@ -200,7 +216,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-10T15:18:37.485Z"
"dateUpdated": "2026-11-11T12:52:51.999Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/85xxx/CVE-2026-85197.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-03T12:45:28.161Z",
"datePublished": "2026-09-04T07:34:31.869Z",
"dateUpdated": "2026-11-04T23:51:33.650Z"
"dateUpdated": "2026-11-11T12:48:01.972Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"defaultStatus": "affected",
"versions": [
{
"version": "0:3.6.6-1.el10_3.9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
@@ -142,6 +160,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98560",
"name": "RHSA-2026:98560",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-85197",
"tags": [
@@ -202,7 +228,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-04T23:51:33.650Z"
"dateUpdated": "2026-11-11T12:48:01.972Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/85xxx/CVE-2026-85234.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-03T14:57:22.051Z",
"datePublished": "2026-09-15T17:58:51.667Z",
"dateUpdated": "2026-11-11T11:47:30.835Z"
"dateUpdated": "2026-11-11T12:59:13.023Z"
},
"containers": {
"cna": {
@@ -120,6 +120,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tftp",
"defaultStatus": "affected",
"versions": [
{
"version": "0:5.2-41.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -176,6 +194,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98457",
"name": "RHSA-2026:98457",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98563",
"name": "RHSA-2026:98563",
@@ -244,7 +270,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:47:30.835Z"
"dateUpdated": "2026-11-11T12:59:13.023Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/86xxx/CVE-2026-86320.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-07T05:35:25.012Z",
"datePublished": "2026-09-17T07:27:33.167Z",
"dateUpdated": "2026-11-03T04:15:37.263Z"
"dateUpdated": "2026-11-11T12:38:37.300Z"
},
"containers": {
"cna": {
@@ -234,6 +234,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "flatpak-builder",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.2.3-1.el9_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -370,6 +388,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98536",
"name": "RHSA-2026:98536",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-86320",
"tags": [
@@ -430,7 +456,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-03T04:15:37.263Z"
"dateUpdated": "2026-11-11T12:38:37.300Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/86xxx/CVE-2026-86856.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-08T15:39:19.083Z",
"datePublished": "2026-10-14T17:52:14.805Z",
"dateUpdated": "2026-11-09T09:54:53.492Z"
"dateUpdated": "2026-11-11T12:20:27.123Z"
},
"containers": {
"cna": {
@@ -103,6 +103,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dpdk",
"defaultStatus": "affected",
"versions": [
{
"version": "2:25.11-2.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 10",
@@ -359,6 +377,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98505",
"name": "RHSA-2026:98505",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-86856",
"tags": [
@@ -416,7 +442,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-09T09:54:53.492Z"
"dateUpdated": "2026-11-11T12:20:27.123Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/87xxx/CVE-2026-87766.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-09T08:08:33.568Z",
"datePublished": "2026-09-09T08:34:35.359Z",
"dateUpdated": "2026-11-02T13:30:15.908Z"
"dateUpdated": "2026-11-11T12:29:58.299Z"
},
"containers": {
"cna": {
@@ -234,6 +234,24 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "bubblewrap",
"defaultStatus": "affected",
"versions": [
{
"version": "0:0.6.3-1.el9_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -380,6 +398,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98521",
"name": "RHSA-2026:98521",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-87766",
"tags": [
@@ -449,7 +475,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-02T13:30:15.908Z"
"dateUpdated": "2026-11-11T12:29:58.299Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/87xxx/CVE-2026-87853.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-09T13:00:35.698Z",
"datePublished": "2026-09-09T16:06:25.638Z",
"dateUpdated": "2026-11-06T01:12:42.092Z"
"dateUpdated": "2026-11-11T12:58:51.396Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "sssd",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.13.1-3.el10_3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -146,6 +164,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98559",
"name": "RHSA-2026:98559",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-87853",
"tags": [
@@ -203,7 +229,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-06T01:12:42.092Z"
"dateUpdated": "2026-11-11T12:58:51.396Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/90xxx/CVE-2026-90947.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T11:41:23.277Z",
"datePublished": "2026-09-14T15:15:14.630Z",
"dateUpdated": "2026-11-05T00:03:46.562Z"
"dateUpdated": "2026-11-11T13:03:41.563Z"
},
"containers": {
"cna": {
@@ -84,6 +84,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"defaultStatus": "affected",
"versions": [
{
"version": "2:3.0.4-8.el9_9.4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -148,6 +166,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98462",
"name": "RHSA-2026:98462",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-90947",
"tags": [
@@ -208,7 +234,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T00:03:46.562Z"
"dateUpdated": "2026-11-11T13:03:41.563Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/90xxx/CVE-2026-90948.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T11:41:23.277Z",
"datePublished": "2026-09-14T13:20:46.729Z",
"dateUpdated": "2026-11-05T00:03:52.124Z"
"dateUpdated": "2026-11-11T13:03:41.584Z"
},
"containers": {
"cna": {
@@ -84,6 +84,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"defaultStatus": "affected",
"versions": [
{
"version": "2:3.0.4-8.el9_9.4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -148,6 +166,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98462",
"name": "RHSA-2026:98462",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-90948",
"tags": [
@@ -208,7 +234,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T00:03:52.124Z"
"dateUpdated": "2026-11-11T13:03:41.584Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/91xxx/CVE-2026-91075.json
+5 -5
View File
@@ -8,14 +8,14 @@
"assignerShortName": "WPScan",
"dateReserved": "2026-09-14T17:19:05.541Z",
"datePublished": "2026-11-03T08:20:22.578Z",
"dateUpdated": "2026-11-04T13:58:57.630Z"
"dateUpdated": "2026-11-11T12:25:38.387Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-03T08:20:22.578Z"
"dateUpdated": "2026-11-11T12:25:38.387Z"
},
"title": "Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass",
"problemTypes": [
@@ -38,17 +38,17 @@
"status": "affected",
"versionType": "semver",
"version": "4.5.0",
"lessThanOrEqual": "4.7.5"
"lessThan": "4.7.6"
}
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it."
"value": "The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 before 4.7.6 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it."
}
],
"references": [
data/2026/91xxx/CVE-2026-91147.json
+48 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T20:35:52.198Z",
"datePublished": "2026-09-18T16:43:51.546Z",
"dateUpdated": "2026-11-09T16:36:27.791Z"
"dateUpdated": "2026-11-11T13:11:50.942Z"
},
"containers": {
"cna": {
@@ -103,6 +103,25 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -122,6 +141,25 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
@@ -188,6 +226,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98463",
"name": "RHSA-2026:98463",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-91147",
"tags": [
@@ -245,7 +291,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-09T16:36:27.791Z"
"dateUpdated": "2026-11-11T13:11:50.942Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/91xxx/CVE-2026-91149.json
+48 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T20:36:28.325Z",
"datePublished": "2026-09-18T16:43:46.021Z",
"dateUpdated": "2026-11-09T15:54:47.308Z"
"dateUpdated": "2026-11-11T13:08:28.513Z"
},
"containers": {
"cna": {
@@ -85,6 +85,25 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -104,6 +123,25 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
@@ -172,6 +210,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98463",
"name": "RHSA-2026:98463",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-91149",
"tags": [
@@ -229,7 +275,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-09T15:54:47.308Z"
"dateUpdated": "2026-11-11T13:08:28.513Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/91xxx/CVE-2026-91202.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T21:58:42.731Z",
"datePublished": "2026-09-18T19:21:11.039Z",
"dateUpdated": "2026-11-11T11:30:51.926Z"
"dateUpdated": "2026-11-11T12:59:10.421Z"
},
"containers": {
"cna": {
@@ -101,6 +101,24 @@
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit-files",
"defaultStatus": "affected",
"versions": [
{
"version": "0:43.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
}
],
"references": [
@@ -120,6 +138,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98458",
"name": "RHSA-2026:98458",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98566",
"name": "RHSA-2026:98566",
@@ -185,7 +211,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:30:51.926Z"
"dateUpdated": "2026-11-11T12:59:10.421Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/91xxx/CVE-2026-91205.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T21:59:16.679Z",
"datePublished": "2026-09-18T19:14:47.221Z",
"dateUpdated": "2026-11-11T11:30:57.219Z"
"dateUpdated": "2026-11-11T12:59:12.375Z"
},
"containers": {
"cna": {
@@ -101,6 +101,24 @@
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit-files",
"defaultStatus": "affected",
"versions": [
{
"version": "0:43.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
}
],
"references": [
@@ -120,6 +138,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98458",
"name": "RHSA-2026:98458",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98566",
"name": "RHSA-2026:98566",
@@ -185,7 +211,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:30:57.219Z"
"dateUpdated": "2026-11-11T12:59:12.375Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/92xxx/CVE-2026-92248.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-15T20:33:46.946Z",
"datePublished": "2026-09-15T22:10:07.541Z",
"dateUpdated": "2026-11-05T00:08:57.974Z"
"dateUpdated": "2026-11-11T13:03:48.533Z"
},
"containers": {
"cna": {
@@ -91,6 +91,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"defaultStatus": "affected",
"versions": [
{
"version": "2:3.0.4-8.el9_9.4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -165,6 +183,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98462",
"name": "RHSA-2026:98462",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-92248",
"tags": [
@@ -225,7 +251,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T00:08:57.974Z"
"dateUpdated": "2026-11-11T13:03:48.533Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/93xxx/CVE-2026-93683.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-18T14:22:36.511Z",
"datePublished": "2026-10-14T15:42:35.398Z",
"dateUpdated": "2026-11-09T09:54:58.153Z"
"dateUpdated": "2026-11-11T12:20:29.968Z"
},
"containers": {
"cna": {
@@ -103,6 +103,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dpdk",
"defaultStatus": "affected",
"versions": [
{
"version": "2:25.11-2.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 10",
@@ -339,6 +357,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98505",
"name": "RHSA-2026:98505",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-93683",
"tags": [
@@ -396,7 +422,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-09T09:54:58.153Z"
"dateUpdated": "2026-11-11T12:20:29.968Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/94xxx/CVE-2026-94125.json
+103
View File
@@ -0,0 +1,103 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-94125",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-09-20T16:04:39.818Z",
"datePublished": "2026-11-11T12:34:27.000Z",
"dateUpdated": "2026-11-11T12:34:27.000Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T12:34:27.000Z"
},
"title": "Apache Storm: Supervisor page discloses worker placement of other users' topologies",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "EXTERNAL"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Storm",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.storm:storm-server",
"packageURL": "pkg:maven/org.apache.storm/storm-server",
"versions": [
{
"status": "affected",
"version": "2.0.0",
"lessThan": "3.2.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"value": "Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue."
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread/8of7kv48thj82bb8vqrz6wbglmyldyvv",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "low"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "kta1kri, independent researcher",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/94xxx/CVE-2026-94184.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-21T01:48:54.590Z",
"datePublished": "2026-09-21T14:17:16.053Z",
"dateUpdated": "2026-11-11T12:03:36.060Z"
"dateUpdated": "2026-11-11T12:59:08.061Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "fetchmail",
"defaultStatus": "affected",
"versions": [
{
"version": "0:6.4.38-3.el10_3.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -174,6 +192,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98583",
"name": "RHSA-2026:98583",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-94184",
"tags": [
@@ -243,7 +269,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:03:36.060Z"
"dateUpdated": "2026-11-11T12:59:08.061Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/96xxx/CVE-2026-96442.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-23T08:58:32.822Z",
"datePublished": "2026-09-23T10:10:36.734Z",
"dateUpdated": "2026-11-05T00:14:27.940Z"
"dateUpdated": "2026-11-11T12:53:55.209Z"
},
"containers": {
"cna": {
@@ -81,6 +81,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "emacs",
"defaultStatus": "affected",
"versions": [
{
"version": "1:29.4-17.el10_3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -183,6 +201,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98574",
"name": "RHSA-2026:98574",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-96442",
"tags": [
@@ -243,7 +269,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T00:14:27.940Z"
"dateUpdated": "2026-11-11T12:53:55.209Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/96xxx/CVE-2026-96889.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-23T18:52:33.922Z",
"datePublished": "2026-09-23T19:40:14.793Z",
"dateUpdated": "2026-11-11T11:57:10.315Z"
"dateUpdated": "2026-11-11T12:53:12.988Z"
},
"containers": {
"cna": {
@@ -84,6 +84,24 @@
"cpe:/o:redhat:enterprise_linux:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glycin-loaders",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.0.1-1.el10_3.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
@@ -1150,6 +1168,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98584",
"name": "RHSA-2026:98584",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98591",
"name": "RHSA-2026:98591",
@@ -1224,7 +1250,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:57:10.315Z"
"dateUpdated": "2026-11-11T12:53:12.988Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/97xxx/CVE-2026-97185.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-24T08:09:01.599Z",
"datePublished": "2026-09-24T08:30:29.489Z",
"dateUpdated": "2026-11-05T00:15:44.647Z"
"dateUpdated": "2026-11-11T13:03:51.605Z"
},
"containers": {
"cna": {
@@ -84,6 +84,24 @@
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"defaultStatus": "affected",
"versions": [
{
"version": "2:3.0.4-8.el9_9.4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
@@ -158,6 +176,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98462",
"name": "RHSA-2026:98462",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-97185",
"tags": [
@@ -218,7 +244,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T00:15:44.647Z"
"dateUpdated": "2026-11-11T13:03:51.605Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/delta.json
+15 -262
View File
@@ -1,273 +1,26 @@
{
"fetchTime": "2026-11-11T12:20:26.230Z",
"numberOfChanges": 44,
"fetchTime": "2026-11-11T13:20:32.783Z",
"numberOfChanges": 3,
"new": [
{
"cveId": "CVE-2026-112201",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112201",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112201.json",
"dateUpdated": "2026-11-11T12:13:45.215Z"
"cveId": "CVE-2026-125850",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125850",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125850.json",
"dateUpdated": "2026-11-11T13:16:12.172Z"
},
{
"cveId": "CVE-2026-122096",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122096",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122096.json",
"dateUpdated": "2026-11-11T12:13:53.275Z"
"cveId": "CVE-2026-40853",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-40853",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/40xxx/CVE-2026-40853.json",
"dateUpdated": "2026-11-11T13:16:13.608Z"
},
{
"cveId": "CVE-2026-124262",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124262",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124262.json",
"dateUpdated": "2026-11-11T12:07:45.699Z"
},
{
"cveId": "CVE-2026-124269",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124269",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124269.json",
"dateUpdated": "2026-11-11T12:08:05.317Z"
},
{
"cveId": "CVE-2026-124411",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124411",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124411.json",
"dateUpdated": "2026-11-11T12:10:08.836Z"
},
{
"cveId": "CVE-2026-124417",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124417",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124417.json",
"dateUpdated": "2026-11-11T12:09:00.883Z"
},
{
"cveId": "CVE-2026-125435",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125435",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125435.json",
"dateUpdated": "2026-11-11T12:10:57.115Z"
},
{
"cveId": "CVE-2026-125445",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125445",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125445.json",
"dateUpdated": "2026-11-11T12:11:23.455Z"
},
{
"cveId": "CVE-2026-125446",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125446",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125446.json",
"dateUpdated": "2026-11-11T12:12:13.920Z"
},
{
"cveId": "CVE-2026-125782",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125782",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125782.json",
"dateUpdated": "2026-11-11T12:11:51.035Z"
}
],
"updated": [
{
"cveId": "CVE-2026-100236",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100236",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100236.json",
"dateUpdated": "2026-11-11T12:15:11.044Z"
},
{
"cveId": "CVE-2026-102556",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102556",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102556.json",
"dateUpdated": "2026-11-11T12:16:14.716Z"
},
{
"cveId": "CVE-2026-102557",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102557",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102557.json",
"dateUpdated": "2026-11-11T12:16:21.745Z"
},
{
"cveId": "CVE-2026-102558",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102558",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102558.json",
"dateUpdated": "2026-11-11T12:16:27.221Z"
},
{
"cveId": "CVE-2026-102559",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102559",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102559.json",
"dateUpdated": "2026-11-11T12:16:32.806Z"
},
{
"cveId": "CVE-2026-102560",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102560",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102560.json",
"dateUpdated": "2026-11-11T12:16:38.381Z"
},
{
"cveId": "CVE-2026-106062",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106062",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106062.json",
"dateUpdated": "2026-11-11T12:07:06.655Z"
},
{
"cveId": "CVE-2026-109832",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109832",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109832.json",
"dateUpdated": "2026-11-11T12:19:24.008Z"
},
{
"cveId": "CVE-2026-112257",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112257",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112257.json",
"dateUpdated": "2026-11-11T12:07:08.371Z"
},
{
"cveId": "CVE-2026-112258",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112258",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112258.json",
"dateUpdated": "2026-11-11T12:07:09.069Z"
},
{
"cveId": "CVE-2026-112260",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112260",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112260.json",
"dateUpdated": "2026-11-11T12:07:11.037Z"
},
{
"cveId": "CVE-2026-112261",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112261",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112261.json",
"dateUpdated": "2026-11-11T12:07:13.456Z"
},
{
"cveId": "CVE-2026-124421",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124421",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124421.json",
"dateUpdated": "2026-11-11T12:06:18.017Z"
},
{
"cveId": "CVE-2026-16118",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16118.json",
"dateUpdated": "2026-11-11T12:19:36.217Z"
},
{
"cveId": "CVE-2026-86561",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86561",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86561.json",
"dateUpdated": "2026-11-11T12:20:12.875Z"
},
{
"cveId": "CVE-2026-86562",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86562",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86562.json",
"dateUpdated": "2026-11-11T12:14:56.710Z"
},
{
"cveId": "CVE-2026-86563",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86563",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86563.json",
"dateUpdated": "2026-11-11T12:14:57.536Z"
},
{
"cveId": "CVE-2026-86565",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86565",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86565.json",
"dateUpdated": "2026-11-11T12:15:02.486Z"
},
{
"cveId": "CVE-2026-86566",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86566",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86566.json",
"dateUpdated": "2026-11-11T12:20:14.269Z"
},
{
"cveId": "CVE-2026-86567",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86567",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86567.json",
"dateUpdated": "2026-11-11T12:15:03.126Z"
},
{
"cveId": "CVE-2026-86845",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86845",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86845.json",
"dateUpdated": "2026-11-11T12:20:15.211Z"
},
{
"cveId": "CVE-2026-86846",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86846",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86846.json",
"dateUpdated": "2026-11-11T12:20:18.228Z"
},
{
"cveId": "CVE-2026-86847",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86847",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86847.json",
"dateUpdated": "2026-11-11T12:20:19.351Z"
},
{
"cveId": "CVE-2026-86848",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86848",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86848.json",
"dateUpdated": "2026-11-11T12:15:08.424Z"
},
{
"cveId": "CVE-2026-86849",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86849",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86849.json",
"dateUpdated": "2026-11-11T12:20:23.123Z"
},
{
"cveId": "CVE-2026-89058",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89058",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89058.json",
"dateUpdated": "2026-11-11T12:09:13.617Z"
},
{
"cveId": "CVE-2026-89059",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89059",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89059.json",
"dateUpdated": "2026-11-11T12:06:33.951Z"
},
{
"cveId": "CVE-2026-92982",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92982",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92982.json",
"dateUpdated": "2026-11-11T12:15:14.361Z"
},
{
"cveId": "CVE-2026-94184",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-94184",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94184.json",
"dateUpdated": "2026-11-11T12:03:36.060Z"
},
{
"cveId": "CVE-2026-95619",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-95619",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95619.json",
"dateUpdated": "2026-11-11T12:06:27.006Z"
},
{
"cveId": "CVE-2026-96275",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96275",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96275.json",
"dateUpdated": "2026-11-11T12:04:21.482Z"
},
{
"cveId": "CVE-2026-96280",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96280",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96280.json",
"dateUpdated": "2026-11-11T12:08:39.010Z"
},
{
"cveId": "CVE-2026-97023",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97023",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97023.json",
"dateUpdated": "2026-11-11T12:04:26.701Z"
},
{
"cveId": "CVE-2026-97024",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97024",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97024.json",
"dateUpdated": "2026-11-11T12:04:29.017Z"
"cveId": "CVE-2026-48479",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-48479",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48479.json",
"dateUpdated": "2026-11-11T13:18:49.334Z"
}
],
"updated": [],
"error": []
}
data/deltaLog.json
+669 -257
View File
@@ -1,4 +1,673 @@
[
{
"fetchTime": "2026-11-11T13:20:32.783Z",
"numberOfChanges": 3,
"new": [
{
"cveId": "CVE-2026-125850",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125850",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125850.json",
"dateUpdated": "2026-11-11T13:16:12.172Z"
},
{
"cveId": "CVE-2026-40853",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-40853",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/40xxx/CVE-2026-40853.json",
"dateUpdated": "2026-11-11T13:16:13.608Z"
},
{
"cveId": "CVE-2026-48479",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-48479",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48479.json",
"dateUpdated": "2026-11-11T13:18:49.334Z"
}
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-11-11T13:14:22.165Z",
"numberOfChanges": 10,
"new": [],
"updated": [
{
"cveId": "CVE-2026-102010",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102010",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102010.json",
"dateUpdated": "2026-11-11T13:02:51.876Z"
},
{
"cveId": "CVE-2026-122096",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122096",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122096.json",
"dateUpdated": "2026-11-11T13:09:23.609Z"
},
{
"cveId": "CVE-2026-125046",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125046",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125046.json",
"dateUpdated": "2026-11-11T13:02:44.252Z"
},
{
"cveId": "CVE-2026-76235",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76235",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76235.json",
"dateUpdated": "2026-11-11T13:11:49.966Z"
},
{
"cveId": "CVE-2026-90947",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90947",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90947.json",
"dateUpdated": "2026-11-11T13:03:41.563Z"
},
{
"cveId": "CVE-2026-90948",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90948",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90948.json",
"dateUpdated": "2026-11-11T13:03:41.584Z"
},
{
"cveId": "CVE-2026-91147",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91147",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91147.json",
"dateUpdated": "2026-11-11T13:11:50.942Z"
},
{
"cveId": "CVE-2026-91149",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91149",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91149.json",
"dateUpdated": "2026-11-11T13:08:28.513Z"
},
{
"cveId": "CVE-2026-92248",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92248",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92248.json",
"dateUpdated": "2026-11-11T13:03:48.533Z"
},
{
"cveId": "CVE-2026-97185",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97185",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97185.json",
"dateUpdated": "2026-11-11T13:03:51.605Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T13:02:34.670Z",
"numberOfChanges": 12,
"new": [
{
"cveId": "CVE-2026-125046",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125046",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125046.json",
"dateUpdated": "2026-11-11T13:02:24.506Z"
},
{
"cveId": "CVE-2026-125454",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125454",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125454.json",
"dateUpdated": "2026-11-11T13:00:40.199Z"
},
{
"cveId": "CVE-2026-125708",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125708",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125708.json",
"dateUpdated": "2026-11-11T13:02:23.291Z"
},
{
"cveId": "CVE-2026-125746",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125746",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125746.json",
"dateUpdated": "2026-11-11T13:01:42.976Z"
}
],
"updated": [
{
"cveId": "CVE-2026-15709",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15709",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15709.json",
"dateUpdated": "2026-11-11T12:57:51.595Z"
},
{
"cveId": "CVE-2026-15711",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15711",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15711.json",
"dateUpdated": "2026-11-11T12:57:51.673Z"
},
{
"cveId": "CVE-2026-16118",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16118.json",
"dateUpdated": "2026-11-11T12:58:11.638Z"
},
{
"cveId": "CVE-2026-85234",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85234",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85234.json",
"dateUpdated": "2026-11-11T12:59:13.023Z"
},
{
"cveId": "CVE-2026-87853",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-87853",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87853.json",
"dateUpdated": "2026-11-11T12:58:51.396Z"
},
{
"cveId": "CVE-2026-91202",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91202",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91202.json",
"dateUpdated": "2026-11-11T12:59:10.421Z"
},
{
"cveId": "CVE-2026-91205",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91205",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91205.json",
"dateUpdated": "2026-11-11T12:59:12.375Z"
},
{
"cveId": "CVE-2026-94184",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-94184",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94184.json",
"dateUpdated": "2026-11-11T12:59:08.061Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T12:56:30.227Z",
"numberOfChanges": 6,
"new": [
{
"cveId": "CVE-2026-125767",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125767",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125767.json",
"dateUpdated": "2026-11-11T12:54:24.794Z"
}
],
"updated": [
{
"cveId": "CVE-2026-125766",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125766",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125766.json",
"dateUpdated": "2026-11-11T12:52:52.747Z"
},
{
"cveId": "CVE-2026-79992",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-79992",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/79xxx/CVE-2026-79992.json",
"dateUpdated": "2026-11-11T12:53:50.949Z"
},
{
"cveId": "CVE-2026-84042",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84042",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84042.json",
"dateUpdated": "2026-11-11T12:52:51.999Z"
},
{
"cveId": "CVE-2026-96442",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96442",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96442.json",
"dateUpdated": "2026-11-11T12:53:55.209Z"
},
{
"cveId": "CVE-2026-96889",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96889",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96889.json",
"dateUpdated": "2026-11-11T12:53:12.988Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T12:50:32.563Z",
"numberOfChanges": 8,
"new": [],
"updated": [
{
"cveId": "CVE-2026-102555",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102555",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102555.json",
"dateUpdated": "2026-11-11T12:48:19.549Z"
},
{
"cveId": "CVE-2026-102556",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102556",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102556.json",
"dateUpdated": "2026-11-11T12:48:34.233Z"
},
{
"cveId": "CVE-2026-102557",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102557",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102557.json",
"dateUpdated": "2026-11-11T12:48:44.547Z"
},
{
"cveId": "CVE-2026-102558",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102558",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102558.json",
"dateUpdated": "2026-11-11T12:48:47.288Z"
},
{
"cveId": "CVE-2026-102559",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102559",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102559.json",
"dateUpdated": "2026-11-11T12:48:52.825Z"
},
{
"cveId": "CVE-2026-102560",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102560",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102560.json",
"dateUpdated": "2026-11-11T12:48:57.325Z"
},
{
"cveId": "CVE-2026-78002",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-78002",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/78xxx/CVE-2026-78002.json",
"dateUpdated": "2026-11-11T12:49:02.652Z"
},
{
"cveId": "CVE-2026-85197",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85197",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85197.json",
"dateUpdated": "2026-11-11T12:48:01.972Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T12:44:38.333Z",
"numberOfChanges": 26,
"new": [
{
"cveId": "CVE-2026-108338",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108338",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108338.json",
"dateUpdated": "2026-11-11T12:39:04.163Z"
},
{
"cveId": "CVE-2026-111824",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111824",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111824.json",
"dateUpdated": "2026-11-11T12:39:22.656Z"
},
{
"cveId": "CVE-2026-118408",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118408",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118408.json",
"dateUpdated": "2026-11-11T12:39:37.621Z"
},
{
"cveId": "CVE-2026-118409",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118409",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118409.json",
"dateUpdated": "2026-11-11T12:39:50.698Z"
},
{
"cveId": "CVE-2026-118410",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118410",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118410.json",
"dateUpdated": "2026-11-11T12:40:00.215Z"
},
{
"cveId": "CVE-2026-118411",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118411",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118411.json",
"dateUpdated": "2026-11-11T12:40:15.264Z"
},
{
"cveId": "CVE-2026-118412",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118412",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118412.json",
"dateUpdated": "2026-11-11T12:40:29.457Z"
},
{
"cveId": "CVE-2026-118413",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118413",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118413.json",
"dateUpdated": "2026-11-11T12:40:47.338Z"
},
{
"cveId": "CVE-2026-118414",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118414",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118414.json",
"dateUpdated": "2026-11-11T12:41:00.425Z"
},
{
"cveId": "CVE-2026-122300",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122300",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122300.json",
"dateUpdated": "2026-11-11T12:41:12.486Z"
},
{
"cveId": "CVE-2026-123374",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123374",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123374.json",
"dateUpdated": "2026-11-11T12:41:36.635Z"
},
{
"cveId": "CVE-2026-123480",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123480",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123480.json",
"dateUpdated": "2026-11-11T12:42:33.630Z"
},
{
"cveId": "CVE-2026-123481",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123481",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123481.json",
"dateUpdated": "2026-11-11T12:41:46.288Z"
},
{
"cveId": "CVE-2026-125433",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125433",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125433.json",
"dateUpdated": "2026-11-11T12:39:15.528Z"
},
{
"cveId": "CVE-2026-125436",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125436",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125436.json",
"dateUpdated": "2026-11-11T12:40:37.418Z"
},
{
"cveId": "CVE-2026-125448",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125448",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125448.json",
"dateUpdated": "2026-11-11T12:42:13.229Z"
},
{
"cveId": "CVE-2026-125743",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125743",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125743.json",
"dateUpdated": "2026-11-11T12:40:03.278Z"
},
{
"cveId": "CVE-2026-125763",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125763",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125763.json",
"dateUpdated": "2026-11-11T12:41:27.183Z"
},
{
"cveId": "CVE-2026-125766",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125766",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125766.json",
"dateUpdated": "2026-11-11T12:42:39.334Z"
}
],
"updated": [
{
"cveId": "CVE-2026-124263",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124263",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124263.json",
"dateUpdated": "2026-11-11T12:39:14.967Z"
},
{
"cveId": "CVE-2026-124416",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124416",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124416.json",
"dateUpdated": "2026-11-11T12:39:52.258Z"
},
{
"cveId": "CVE-2026-125778",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125778",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125778.json",
"dateUpdated": "2026-11-11T12:39:34.805Z"
},
{
"cveId": "CVE-2026-16313",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-16313",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16313.json",
"dateUpdated": "2026-11-11T12:40:47.775Z"
},
{
"cveId": "CVE-2026-42011",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42011",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42011.json",
"dateUpdated": "2026-11-11T12:41:31.479Z"
},
{
"cveId": "CVE-2026-42013",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42013",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42013.json",
"dateUpdated": "2026-11-11T12:41:33.254Z"
},
{
"cveId": "CVE-2026-78002",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-78002",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/78xxx/CVE-2026-78002.json",
"dateUpdated": "2026-11-11T12:40:12.586Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T12:39:02.176Z",
"numberOfChanges": 23,
"new": [
{
"cveId": "CVE-2026-105152",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105152",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105152.json",
"dateUpdated": "2026-11-11T12:38:14.723Z"
},
{
"cveId": "CVE-2026-105153",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105153",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105153.json",
"dateUpdated": "2026-11-11T12:38:36.244Z"
},
{
"cveId": "CVE-2026-105154",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105154",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105154.json",
"dateUpdated": "2026-11-11T12:38:54.004Z"
},
{
"cveId": "CVE-2026-118405",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118405",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118405.json",
"dateUpdated": "2026-11-11T12:38:01.461Z"
},
{
"cveId": "CVE-2026-124261",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124261",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124261.json",
"dateUpdated": "2026-11-11T12:38:08.129Z"
},
{
"cveId": "CVE-2026-124263",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124263",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124263.json",
"dateUpdated": "2026-11-11T12:38:14.639Z"
},
{
"cveId": "CVE-2026-124416",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124416",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124416.json",
"dateUpdated": "2026-11-11T12:38:52.064Z"
},
{
"cveId": "CVE-2026-124495",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124495",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124495.json",
"dateUpdated": "2026-11-11T12:34:51.298Z"
},
{
"cveId": "CVE-2026-124496",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124496",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124496.json",
"dateUpdated": "2026-11-11T12:35:22.344Z"
},
{
"cveId": "CVE-2026-125045",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125045",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125045.json",
"dateUpdated": "2026-11-11T12:35:31.243Z"
},
{
"cveId": "CVE-2026-125431",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125431",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125431.json",
"dateUpdated": "2026-11-11T12:37:38.047Z"
},
{
"cveId": "CVE-2026-125450",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125450",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125450.json",
"dateUpdated": "2026-11-11T12:35:19.626Z"
},
{
"cveId": "CVE-2026-125762",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125762",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125762.json",
"dateUpdated": "2026-11-11T12:35:55.754Z"
},
{
"cveId": "CVE-2026-125776",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125776",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125776.json",
"dateUpdated": "2026-11-11T12:36:32.411Z"
},
{
"cveId": "CVE-2026-125778",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125778",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125778.json",
"dateUpdated": "2026-11-11T12:38:33.446Z"
},
{
"cveId": "CVE-2026-126537",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126537",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126537.json",
"dateUpdated": "2026-11-11T12:34:45.417Z"
},
{
"cveId": "CVE-2026-94125",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-94125",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94125.json",
"dateUpdated": "2026-11-11T12:34:27.000Z"
}
],
"updated": [
{
"cveId": "CVE-2026-114690",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114690",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114690.json",
"dateUpdated": "2026-11-11T12:38:11.959Z"
},
{
"cveId": "CVE-2026-114691",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114691",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114691.json",
"dateUpdated": "2026-11-11T12:38:11.970Z"
},
{
"cveId": "CVE-2026-115455",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115455",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115455.json",
"dateUpdated": "2026-11-11T12:38:16.540Z"
},
{
"cveId": "CVE-2026-115456",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115456",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115456.json",
"dateUpdated": "2026-11-11T12:38:22.898Z"
},
{
"cveId": "CVE-2026-119528",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119528",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119528.json",
"dateUpdated": "2026-11-11T12:35:24.492Z"
},
{
"cveId": "CVE-2026-86320",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86320",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86320.json",
"dateUpdated": "2026-11-11T12:38:37.300Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T12:30:33.482Z",
"numberOfChanges": 12,
"new": [
{
"cveId": "CVE-2026-124744",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124744",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124744.json",
"dateUpdated": "2026-11-11T12:29:17.756Z"
},
{
"cveId": "CVE-2026-124745",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124745",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124745.json",
"dateUpdated": "2026-11-11T12:29:18.382Z"
},
{
"cveId": "CVE-2026-126658",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126658",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126658.json",
"dateUpdated": "2026-11-11T12:24:35.975Z"
},
{
"cveId": "CVE-2026-126659",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126659",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126659.json",
"dateUpdated": "2026-11-11T12:24:36.624Z"
},
{
"cveId": "CVE-2026-126662",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126662",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126662.json",
"dateUpdated": "2026-11-11T12:24:37.304Z"
},
{
"cveId": "CVE-2026-126663",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126663",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126663.json",
"dateUpdated": "2026-11-11T12:24:38.010Z"
}
],
"updated": [
{
"cveId": "CVE-2026-15709",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15709",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15709.json",
"dateUpdated": "2026-11-11T12:26:31.849Z"
},
{
"cveId": "CVE-2026-15711",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15711",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15711.json",
"dateUpdated": "2026-11-11T12:26:33.140Z"
},
{
"cveId": "CVE-2026-86856",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86856",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86856.json",
"dateUpdated": "2026-11-11T12:20:27.123Z"
},
{
"cveId": "CVE-2026-87766",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-87766",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87766.json",
"dateUpdated": "2026-11-11T12:29:58.299Z"
},
{
"cveId": "CVE-2026-91075",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91075",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91075.json",
"dateUpdated": "2026-11-11T12:25:38.387Z"
},
{
"cveId": "CVE-2026-93683",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93683",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93683.json",
"dateUpdated": "2026-11-11T12:20:29.968Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T12:20:26.230Z",
"numberOfChanges": 44,
@@ -840960,262 +841629,5 @@
}
],
"error": []
},
{
"fetchTime": "2026-10-12T13:14:03.560Z",
"numberOfChanges": 29,
"new": [
{
"cveId": "CVE-2026-105081",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105081",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105081.json",
"dateUpdated": "2026-10-12T13:10:29.543Z"
},
{
"cveId": "CVE-2026-108836",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108836",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108836.json",
"dateUpdated": "2026-10-12T12:45:16.156Z"
},
{
"cveId": "CVE-2026-108889",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108889",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108889.json",
"dateUpdated": "2026-10-12T13:00:15.760Z"
},
{
"cveId": "CVE-2026-109164",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109164",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109164.json",
"dateUpdated": "2026-10-12T13:10:30.268Z"
},
{
"cveId": "CVE-2026-109165",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109165",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109165.json",
"dateUpdated": "2026-10-12T13:10:30.927Z"
},
{
"cveId": "CVE-2026-109166",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109166",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109166.json",
"dateUpdated": "2026-10-12T13:10:31.628Z"
},
{
"cveId": "CVE-2026-109167",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109167",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109167.json",
"dateUpdated": "2026-10-12T13:10:32.289Z"
},
{
"cveId": "CVE-2026-109168",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109168",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109168.json",
"dateUpdated": "2026-10-12T13:10:32.919Z"
},
{
"cveId": "CVE-2026-109171",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109171",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109171.json",
"dateUpdated": "2026-10-12T13:10:33.592Z"
},
{
"cveId": "CVE-2026-109172",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109172",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109172.json",
"dateUpdated": "2026-10-12T13:10:34.283Z"
},
{
"cveId": "CVE-2026-109173",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109173",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109173.json",
"dateUpdated": "2026-10-12T13:10:34.985Z"
},
{
"cveId": "CVE-2026-109174",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109174",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109174.json",
"dateUpdated": "2026-10-12T13:10:35.666Z"
},
{
"cveId": "CVE-2026-109175",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109175",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109175.json",
"dateUpdated": "2026-10-12T13:10:36.311Z"
},
{
"cveId": "CVE-2026-109176",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109176",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109176.json",
"dateUpdated": "2026-10-12T13:10:37.009Z"
},
{
"cveId": "CVE-2026-109177",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109177",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109177.json",
"dateUpdated": "2026-10-12T13:10:37.712Z"
},
{
"cveId": "CVE-2026-109178",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109178",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109178.json",
"dateUpdated": "2026-10-12T13:10:38.401Z"
},
{
"cveId": "CVE-2026-109179",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109179",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109179.json",
"dateUpdated": "2026-10-12T13:10:39.033Z"
},
{
"cveId": "CVE-2026-109180",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109180",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109180.json",
"dateUpdated": "2026-10-12T13:10:39.723Z"
},
{
"cveId": "CVE-2026-109181",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109181",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109181.json",
"dateUpdated": "2026-10-12T13:10:40.395Z"
},
{
"cveId": "CVE-2026-109182",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109182",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109182.json",
"dateUpdated": "2026-10-12T13:10:42.803Z"
},
{
"cveId": "CVE-2026-109183",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109183",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109183.json",
"dateUpdated": "2026-10-12T13:10:43.540Z"
},
{
"cveId": "CVE-2026-109184",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109184",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109184.json",
"dateUpdated": "2026-10-12T13:10:44.279Z"
},
{
"cveId": "CVE-2026-109185",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109185",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109185.json",
"dateUpdated": "2026-10-12T13:10:44.971Z"
},
{
"cveId": "CVE-2026-109186",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109186",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109186.json",
"dateUpdated": "2026-10-12T13:10:45.663Z"
},
{
"cveId": "CVE-2026-109187",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109187",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109187.json",
"dateUpdated": "2026-10-12T13:10:46.387Z"
},
{
"cveId": "CVE-2026-109188",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109188",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109188.json",
"dateUpdated": "2026-10-12T13:10:47.078Z"
},
{
"cveId": "CVE-2026-93693",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93693",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93693.json",
"dateUpdated": "2026-10-12T12:48:53.652Z"
},
{
"cveId": "CVE-2026-93694",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93694",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93694.json",
"dateUpdated": "2026-10-12T12:50:22.621Z"
},
{
"cveId": "CVE-2026-93695",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93695",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93695.json",
"dateUpdated": "2026-10-12T12:52:15.973Z"
}
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-10-12T12:31:22.112Z",
"numberOfChanges": 11,
"new": [
{
"cveId": "CVE-2026-108831",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108831",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108831.json",
"dateUpdated": "2026-10-12T12:00:15.592Z"
},
{
"cveId": "CVE-2026-108834",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108834",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108834.json",
"dateUpdated": "2026-10-12T12:15:13.123Z"
},
{
"cveId": "CVE-2026-108835",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108835",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108835.json",
"dateUpdated": "2026-10-12T12:30:08.884Z"
},
{
"cveId": "CVE-2026-108950",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108950",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108950.json",
"dateUpdated": "2026-10-12T12:13:03.464Z"
},
{
"cveId": "CVE-2026-108951",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108951",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108951.json",
"dateUpdated": "2026-10-12T12:13:04.153Z"
},
{
"cveId": "CVE-2026-108952",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108952",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108952.json",
"dateUpdated": "2026-10-12T12:13:04.800Z"
},
{
"cveId": "CVE-2026-108953",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108953",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108953.json",
"dateUpdated": "2026-10-12T12:13:05.422Z"
},
{
"cveId": "CVE-2026-52903",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-52903",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/52xxx/CVE-2026-52903.json",
"dateUpdated": "2026-10-12T12:16:00.508Z"
}
],
"updated": [
{
"cveId": "CVE-2026-27408",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-27408",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/27xxx/CVE-2026-27408.json",
"dateUpdated": "2026-10-12T12:28:17.107Z"
},
{
"cveId": "CVE-2026-77812",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-77812",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77812.json",
"dateUpdated": "2026-10-12T12:14:20.097Z"
},
{
"cveId": "CVE-2026-78306",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-78306",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/78xxx/CVE-2026-78306.json",
"dateUpdated": "2026-10-12T12:09:08.628Z"
}
],
"error": []
}
]
state/sync.json
+3 -3
View File
@@ -1,7 +1,7 @@
{
"source": "https://github.com/CVEProject/cvelistV5.git",
"upstream_commit": "a1cfe8feb4a5352430e2f3089ae42f0b92b066d6",
"upstream_commit": "6644e39b576fca9a55ad2999e9517ca74bff78da",
"since_year": 2017,
"records": 330938,
"synced_at_utc": "2026-11-11T12:43:22.804914+00:00"
"records": 330988,
"synced_at_utc": "2026-11-11T13:33:43.757573+00:00"
}