diff --git a/data/2026/102xxx/CVE-2026-102359.json b/data/2026/102xxx/CVE-2026-102359.json index 6745e3d306..c1d42f3190 100644 --- a/data/2026/102xxx/CVE-2026-102359.json +++ b/data/2026/102xxx/CVE-2026-102359.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-09-28T22:38:42.255Z", "datePublished": "2026-11-06T17:36:09.840Z", - "dateUpdated": "2026-11-06T17:36:09.840Z" + "dateUpdated": "2026-11-11T03:13:53.054Z" }, "containers": { "cna": { @@ -93,6 +93,48 @@ "advisory": "GHSA-r54f-fq6c-53vw", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:13:29.742291Z", + "id": "CVE-2026-102359", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:13:53.054Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/106xxx/CVE-2026-106019.json b/data/2026/106xxx/CVE-2026-106019.json index a0809db704..ada77b0846 100644 --- a/data/2026/106xxx/CVE-2026-106019.json +++ b/data/2026/106xxx/CVE-2026-106019.json @@ -8,7 +8,7 @@ "assignerShortName": "jci", "dateReserved": "2026-10-06T12:44:52.563Z", "datePublished": "2026-11-06T14:21:36.622Z", - "dateUpdated": "2026-11-06T14:21:36.622Z" + "dateUpdated": "2026-11-11T02:57:47.750Z" }, "containers": { "cna": { @@ -112,6 +112,40 @@ "x_generator": { "engine": "Vulnogram 1.0.5" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T02:57:38.441044Z", + "id": "CVE-2026-106019", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T02:57:47.750Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/108xxx/CVE-2026-108262.json b/data/2026/108xxx/CVE-2026-108262.json index 4023073da0..70f3285ed0 100644 --- a/data/2026/108xxx/CVE-2026-108262.json +++ b/data/2026/108xxx/CVE-2026-108262.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-10-09T17:33:15.410Z", "datePublished": "2026-11-06T18:29:49.225Z", - "dateUpdated": "2026-11-06T18:29:49.225Z" + "dateUpdated": "2026-11-11T03:16:39.472Z" }, "containers": { "cna": { @@ -89,6 +89,40 @@ "advisory": "GHSA-9hq4-hm3j-jmph", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:16:29.590639Z", + "id": "CVE-2026-108262", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:16:39.472Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/112xxx/CVE-2026-112335.json b/data/2026/112xxx/CVE-2026-112335.json index 5138be2935..f97fb308c9 100644 --- a/data/2026/112xxx/CVE-2026-112335.json +++ b/data/2026/112xxx/CVE-2026-112335.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-10-19T14:41:46.701Z", "datePublished": "2026-11-06T15:00:43.252Z", - "dateUpdated": "2026-11-06T15:00:43.252Z" + "dateUpdated": "2026-11-11T02:58:54.636Z" }, "containers": { "cna": { @@ -153,6 +153,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3gq8-gg8f-5h8h", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T02:58:28.657686Z", + "id": "CVE-2026-112335", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T02:58:54.636Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/112xxx/CVE-2026-112339.json b/data/2026/112xxx/CVE-2026-112339.json index 94feeb4604..c9dc2b7d1f 100644 --- a/data/2026/112xxx/CVE-2026-112339.json +++ b/data/2026/112xxx/CVE-2026-112339.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-10-19T14:41:46.701Z", "datePublished": "2026-11-06T15:00:45.884Z", - "dateUpdated": "2026-11-06T15:00:45.884Z" + "dateUpdated": "2026-11-11T03:00:14.774Z" }, "containers": { "cna": { @@ -174,6 +174,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-v8ww-qhjh-j6w9", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T02:59:44.271378Z", + "id": "CVE-2026-112339", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:00:14.774Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/116xxx/CVE-2026-116645.json b/data/2026/116xxx/CVE-2026-116645.json new file mode 100644 index 0000000000..24f4fa101b --- /dev/null +++ b/data/2026/116xxx/CVE-2026-116645.json @@ -0,0 +1,225 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-116645", + "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", + "state": "PUBLISHED", + "assignerShortName": "Fluid Attacks", + "dateReserved": "2026-10-26T19:01:24.882Z", + "datePublished": "2026-11-11T02:47:14.028Z", + "dateUpdated": "2026-11-11T02:50:53.016Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", + "shortName": "Fluid Attacks", + "dateUpdated": "2026-11-11T02:50:53.016Z" + }, + "title": "LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-66", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-66 SQL Injection" + } + ] + } + ], + "affected": [ + { + "vendor": "LimeSurvey", + "product": "LimeSurvey Community Edition", + "platforms": [ + "Windows", + "MacOS", + "Linux" + ], + "repo": "https://github.com/LimeSurvey/LimeSurvey", + "versions": [ + { + "status": "affected", + "version": "7.8.0" + } + ], + "defaultStatus": "affected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:limesurvey:limesurvey_community_edition:7.8.0:*:windows:*:*:*:*:*" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:limesurvey:limesurvey_community_edition:7.8.0:*:macos:*:*:*:*:*" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:limesurvey:limesurvey_community_edition:7.8.0:*:linux:*:*:*:*:*" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges." + } + ] + } + ], + "references": [ + { + "url": "https://fluidattacks.com/es/advisories/pantera", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/", + "tags": [ + "product" + ] + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/admin/import_helper.php", + "tags": [ + "technical-description" + ] + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/export_helper.php", + "tags": [ + "technical-description" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 7.1, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + } + ], + "workarounds": [ + { + "lang": "en", + "value": "Do not grant untrusted accounts global survey-creation permission and do not import untrusted .lsa archives. Review imported participant-table schemas for unexpected attribute column names.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Do not grant untrusted accounts global survey-creation permission and do not import untrusted .lsa archives. Review imported participant-table schemas for unexpected attribute column names." + } + ] + } + ], + "solutions": [ + { + "lang": "en", + "value": "Apply an upstream patch that strictly validates imported participant attribute identifiers and always quotes schema-derived identifiers before constructing the SPSS export SELECT list. Upgrade to the vendor-fixed release once one is published.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Apply an upstream patch that strictly validates imported participant attribute identifiers and always quotes schema-derived identifiers before constructing the SPSS export SELECT list. Upgrade to the vendor-fixed release once one is published." + } + ] + } + ], + "timeline": [ + { + "time": "2026-10-27T02:43:00.000Z", + "lang": "en", + "value": "Vulnerability discovered" + }, + { + "time": "2026-10-27T16:05:00.000Z", + "lang": "en", + "value": "Vendor contacted" + }, + { + "time": "2026-11-11T02:44:00.000Z", + "lang": "en", + "value": "Public disclosure" + } + ], + "credits": [ + { + "lang": "en", + "value": "Fluid Attacks' AI SAST Scanner", + "type": "finder" + }, + { + "lang": "en", + "value": "Miguel Gómez", + "type": "finder" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/118xxx/CVE-2026-118515.json b/data/2026/118xxx/CVE-2026-118515.json index 6b4cbf1d06..ee4df1690d 100644 --- a/data/2026/118xxx/CVE-2026-118515.json +++ b/data/2026/118xxx/CVE-2026-118515.json @@ -8,7 +8,7 @@ "assignerShortName": "Checkmarx", "dateReserved": "2026-10-28T14:33:36.992Z", "datePublished": "2026-11-06T16:17:01.487Z", - "dateUpdated": "2026-11-06T16:17:01.487Z" + "dateUpdated": "2026-11-11T03:10:02.952Z" }, "containers": { "cna": { @@ -193,6 +193,40 @@ "x_generator": { "engine": "Vulnogram 1.0.5" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:09:45.846853Z", + "id": "CVE-2026-118515", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:10:02.952Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/120xxx/CVE-2026-120244.json b/data/2026/120xxx/CVE-2026-120244.json index f395ffd0e3..7ac67cf94f 100644 --- a/data/2026/120xxx/CVE-2026-120244.json +++ b/data/2026/120xxx/CVE-2026-120244.json @@ -8,21 +8,21 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-10-31T22:05:57.768Z", "datePublished": "2026-11-01T00:57:10.036Z", - "dateUpdated": "2026-11-02T17:44:48.638Z" + "dateUpdated": "2026-11-11T02:37:13.267Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", - "dateUpdated": "2026-11-01T00:57:10.036Z" + "dateUpdated": "2026-11-11T02:37:13.267Z" }, "datePublic": "2026-10-11T00:00:00.000Z", "title": "FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder", "descriptions": [ { "lang": "en", - "value": "FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels." + "value": "FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels." } ], "problemTypes": [ @@ -149,6 +149,11 @@ "lang": "en", "value": "Adrian Junge (vurlo)", "type": "finder" + }, + { + "lang": "en", + "value": "Joshua Rogers (AISLE Research)", + "type": "reporter" } ], "x_generator": { diff --git a/data/2026/120xxx/CVE-2026-120245.json b/data/2026/120xxx/CVE-2026-120245.json index c1585abe37..9c4fb04822 100644 --- a/data/2026/120xxx/CVE-2026-120245.json +++ b/data/2026/120xxx/CVE-2026-120245.json @@ -8,21 +8,21 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-10-31T22:05:58.146Z", "datePublished": "2026-11-01T00:57:10.732Z", - "dateUpdated": "2026-11-02T14:40:04.609Z" + "dateUpdated": "2026-11-11T02:37:14.008Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", - "dateUpdated": "2026-11-01T00:57:10.732Z" + "dateUpdated": "2026-11-11T02:37:14.008Z" }, "datePublic": "2026-10-10T00:00:00.000Z", "title": "FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder", "descriptions": [ { "lang": "en", - "value": "FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output." + "value": "FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture." } ], "problemTypes": [ @@ -155,6 +155,11 @@ "lang": "en", "value": "Adrian Junge (vurlo)", "type": "finder" + }, + { + "lang": "en", + "value": "Joshua Rogers (AISLE Research)", + "type": "reporter" } ], "x_generator": { diff --git a/data/2026/121xxx/CVE-2026-121454.json b/data/2026/121xxx/CVE-2026-121454.json index dd147178b5..41d04a593d 100644 --- a/data/2026/121xxx/CVE-2026-121454.json +++ b/data/2026/121xxx/CVE-2026-121454.json @@ -8,21 +8,21 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-03T12:33:53.717Z", "datePublished": "2026-11-03T15:17:03.132Z", - "dateUpdated": "2026-11-07T03:06:24.553Z" + "dateUpdated": "2026-11-11T02:37:14.675Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", - "dateUpdated": "2026-11-03T15:17:03.132Z" + "dateUpdated": "2026-11-11T02:37:14.675Z" }, "datePublic": "2026-10-25T00:00:00.000Z", - "title": "Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests", + "title": "Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requests", "descriptions": [ { "lang": "en", - "value": "Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships." + "value": "Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships." } ], "problemTypes": [ @@ -46,9 +46,14 @@ "versions": [ { "version": "0", - "lessThanOrEqual": "4.3.0", - "versionType": "semver", - "status": "affected" + "lessThan": "4.3.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "4.3.1", + "status": "unaffected", + "versionType": "semver" } ] } diff --git a/data/2026/123xxx/CVE-2026-123486.json b/data/2026/123xxx/CVE-2026-123486.json index 0036dff2a1..4a852b452c 100644 --- a/data/2026/123xxx/CVE-2026-123486.json +++ b/data/2026/123xxx/CVE-2026-123486.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:44:37.658Z", "datePublished": "2026-11-06T15:00:48.677Z", - "dateUpdated": "2026-11-06T15:00:48.677Z" + "dateUpdated": "2026-11-11T03:01:33.272Z" }, "containers": { "cna": { @@ -135,6 +135,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:00:53.262624Z", + "id": "CVE-2026-123486", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:01:33.272Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123490.json b/data/2026/123xxx/CVE-2026-123490.json index 415bd4ad80..ba1412ca6e 100644 --- a/data/2026/123xxx/CVE-2026-123490.json +++ b/data/2026/123xxx/CVE-2026-123490.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:44:37.658Z", "datePublished": "2026-11-06T15:00:51.473Z", - "dateUpdated": "2026-11-06T15:00:51.473Z" + "dateUpdated": "2026-11-11T03:02:28.975Z" }, "containers": { "cna": { @@ -147,6 +147,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:02:18.142212Z", + "id": "CVE-2026-123490", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:02:28.975Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123618.json b/data/2026/123xxx/CVE-2026-123618.json index 10c295194c..86091be51c 100644 --- a/data/2026/123xxx/CVE-2026-123618.json +++ b/data/2026/123xxx/CVE-2026-123618.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T01:04:42.201Z", "datePublished": "2026-11-06T15:00:54.268Z", - "dateUpdated": "2026-11-06T15:00:54.268Z" + "dateUpdated": "2026-11-11T03:03:36.682Z" }, "containers": { "cna": { @@ -158,6 +158,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:03:26.743219Z", + "id": "CVE-2026-123618", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:03:36.682Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123622.json b/data/2026/123xxx/CVE-2026-123622.json index 59a3f733f9..79365421fe 100644 --- a/data/2026/123xxx/CVE-2026-123622.json +++ b/data/2026/123xxx/CVE-2026-123622.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T01:04:42.202Z", "datePublished": "2026-11-06T15:00:57.104Z", - "dateUpdated": "2026-11-06T15:00:57.104Z" + "dateUpdated": "2026-11-11T03:05:29.613Z" }, "containers": { "cna": { @@ -167,6 +167,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://hackmd.io/@leediay/H144QKY6zl", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:04:53.172707Z", + "id": "CVE-2026-123622", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:05:29.613Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123623.json b/data/2026/123xxx/CVE-2026-123623.json index 29ddf115f7..7e77369ba3 100644 --- a/data/2026/123xxx/CVE-2026-123623.json +++ b/data/2026/123xxx/CVE-2026-123623.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T01:04:42.202Z", "datePublished": "2026-11-06T15:16:05.169Z", - "dateUpdated": "2026-11-06T15:16:05.169Z" + "dateUpdated": "2026-11-11T03:07:33.112Z" }, "containers": { "cna": { @@ -158,6 +158,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:07:17.940854Z", + "id": "CVE-2026-123623", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:07:33.112Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123676.json b/data/2026/123xxx/CVE-2026-123676.json index 64f204b01e..dab879cfc4 100644 --- a/data/2026/123xxx/CVE-2026-123676.json +++ b/data/2026/123xxx/CVE-2026-123676.json @@ -8,7 +8,7 @@ "assignerShortName": "VulDB", "dateReserved": "2026-11-06T09:38:50.094Z", "datePublished": "2026-11-06T15:30:23.322Z", - "dateUpdated": "2026-11-06T15:30:23.322Z" + "dateUpdated": "2026-11-11T03:08:22.186Z" }, "containers": { "cna": { @@ -229,6 +229,40 @@ "x_generator": [ "VulDB PVTS v202611" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:08:10.003313Z", + "id": "CVE-2026-123676", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:08:22.186Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123784.json b/data/2026/123xxx/CVE-2026-123784.json index 870bc99433..dab13f6b58 100644 --- a/data/2026/123xxx/CVE-2026-123784.json +++ b/data/2026/123xxx/CVE-2026-123784.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T14:37:46.094Z", "datePublished": "2026-11-06T15:01:00.678Z", - "dateUpdated": "2026-11-06T15:01:00.678Z" + "dateUpdated": "2026-11-11T03:06:39.965Z" }, "containers": { "cna": { @@ -144,6 +144,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:06:30.379337Z", + "id": "CVE-2026-123784", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:06:39.965Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126559.json b/data/2026/126xxx/CVE-2026-126559.json new file mode 100644 index 0000000000..2dc4f381a8 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126559.json @@ -0,0 +1,166 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126559", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:08:18.407Z", + "datePublished": "2026-11-11T02:35:56.604Z", + "dateUpdated": "2026-11-11T02:35:56.604Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:35:56.604Z" + }, + "datePublic": "2026-11-10T23:29:45.000Z", + "title": "Semantic MediaWiki 4.2.0 before 7.4.1 Stored XSS via Special:FacetedSearch", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "4.2.0", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "4.2.0", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "HIGH", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "LOW", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "baseScore": 4.8, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 4.8, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-cw86-j46r-2x7x", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-cw86-j46r-2x7x)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/92999fc0de74324aaa35bfd3676cd4d145d2ac06", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/FacetedSearch/OptionsBuilder.php#L27-L52", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 4.2.0 before 7.4.1 Stored XSS via Special:FacetedSearch", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-4.2.0-before-7.4.1-stored-xss-via-special-facetedsearch" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126560.json b/data/2026/126xxx/CVE-2026-126560.json new file mode 100644 index 0000000000..08cbfb2e37 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126560.json @@ -0,0 +1,166 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126560", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:08:18.780Z", + "datePublished": "2026-11-11T02:35:57.283Z", + "dateUpdated": "2026-11-11T02:35:57.283Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:35:57.283Z" + }, + "datePublic": "2026-11-10T23:29:43.000Z", + "title": "Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via data-search Attributes", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes, executing script in viewers' browsers including administrators." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "3.0.0", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "3.0.0", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "LOW", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "baseScore": 5.1, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 5.4, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-gg2q-rc52-22pp", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-gg2q-rc52-22pp)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/db7f59461a7815416a719b71ce48fb76481ecaf2", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/res/smw/printer/ext.smw.tableprinter.js#L349-L357", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via data-search Attributes", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-data-search-attributes" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126561.json b/data/2026/126xxx/CVE-2026-126561.json new file mode 100644 index 0000000000..8434c3b389 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126561.json @@ -0,0 +1,166 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126561", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:08:19.156Z", + "datePublished": "2026-11-11T02:35:57.916Z", + "dateUpdated": "2026-11-11T02:35:57.916Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:35:57.916Z" + }, + "datePublic": "2026-11-10T23:29:38.000Z", + "title": "Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Missing Authorization", + "cweId": "CWE-862", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "2.5.0", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "2.5.0", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 7.1, + "baseSeverity": "HIGH" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "HIGH", + "baseScore": 7.1, + "baseSeverity": "HIGH" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9w3p-9m8x-j2mw", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-9w3p-9m8x-j2mw)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/ca81329c74aa64077f367e02ad00c079458ef10a", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Protection/ProtectionValidator.php#L293-L311", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.4.1-missing-authorization-via-is-edit-protected-annotation" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126562.json b/data/2026/126xxx/CVE-2026-126562.json new file mode 100644 index 0000000000..eab66a79f3 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126562.json @@ -0,0 +1,166 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126562", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:08:19.523Z", + "datePublished": "2026-11-11T02:35:58.607Z", + "dateUpdated": "2026-11-11T02:35:58.607Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:35:58.607Z" + }, + "datePublic": "2026-11-10T23:29:44.000Z", + "title": "Semantic MediaWiki 3.0.0 before 7.4.1 Uncontrolled Recursion via ElasticStore ConceptDescriptionInterpreter", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concept page views, Special:Ask, or api.php action=ask queries to exhaust PHP memory or stack." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Uncontrolled Recursion", + "cweId": "CWE-674", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "3.0.0", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "3.0.0", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "LOW", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jwx8-mm92-gv95", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-jwx8-mm92-gv95)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/35d8f8c9c7b48a476751ca0b795b78b648756828", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Elastic/QueryEngine/DescriptionInterpreters/ConceptDescriptionInterpreter.php#L34-L75", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 3.0.0 before 7.4.1 Uncontrolled Recursion via ElasticStore ConceptDescriptionInterpreter", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-uncontrolled-recursion-via-elasticstore-conceptdescriptioninterpreter" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126563.json b/data/2026/126xxx/CVE-2026-126563.json new file mode 100644 index 0000000000..4453fc63a5 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126563.json @@ -0,0 +1,166 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126563", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:08:19.888Z", + "datePublished": "2026-11-11T02:35:59.252Z", + "dateUpdated": "2026-11-11T02:35:59.252Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:35:59.252Z" + }, + "datePublic": "2026-11-10T23:29:40.000Z", + "title": "Semantic MediaWiki 2.4.0 before 7.4.1 Reflected XSS via Special:Ask Date Format", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "2.4.0", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "2.4.0", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "LOW", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 6.1, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-h252-mj7p-58q7", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-h252-mj7p-58q7)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/01cb81a6da7af743d2a5eb334db10e52b7318c56", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/DataValues/ValueFormatters/TimeValueFormatter.php#L312-L340", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 2.4.0 before 7.4.1 Reflected XSS via Special:Ask Date Format", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-2.4.0-before-7.4.1-reflected-xss-via-special-ask-date-format" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126564.json b/data/2026/126xxx/CVE-2026-126564.json new file mode 100644 index 0000000000..632527a21d --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126564.json @@ -0,0 +1,166 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126564", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:43:08.612Z", + "datePublished": "2026-11-11T02:35:59.923Z", + "dateUpdated": "2026-11-11T02:35:59.923Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:35:59.923Z" + }, + "datePublic": "2026-11-10T23:29:41.000Z", + "title": "Semantic MediaWiki 2.5.0 before 7.4.1 Stored XSS via Special:Browse Factbox Title", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal   as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "2.5.0", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "2.5.0", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "LOW", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "baseScore": 5.1, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 5.4, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-mc5x-2j7v-x8hp", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-mc5x-2j7v-x8hp)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/c9bf9f25549bb2f5eab916339b267a1732002c4c", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/Browse/ValueFormatter.php#L34-L55", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 2.5.0 before 7.4.1 Stored XSS via Special:Browse Factbox Title", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.4.1-stored-xss-via-special-browse-factbox-title" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126565.json b/data/2026/126xxx/CVE-2026-126565.json new file mode 100644 index 0000000000..6a97ff1699 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126565.json @@ -0,0 +1,172 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126565", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:43:08.994Z", + "datePublished": "2026-11-11T02:36:00.573Z", + "dateUpdated": "2026-11-11T02:36:00.573Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:36:00.573Z" + }, + "datePublic": "2026-11-10T23:29:46.000Z", + "title": "Semantic MediaWiki 3.0.0 before 7.4.1 DoS via Exponential Concept Expansion", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of Concept: pages that fan out, so queries via concept page views, Special:Ask, or api.php action=ask exhaust CPU and memory." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Inefficient Algorithmic Complexity", + "cweId": "CWE-407", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "3.0.0", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "3.0.0", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "LOW", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-24v2-mf3g-84ch", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-24v2-mf3g-84ch)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/86ce13254ffd91406ef43ea403ae072a7e3a38b3", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Elastic/QueryEngine/DescriptionInterpreters/ConceptDescriptionInterpreter.php#L34-L75", + "tags": [ + "technical-description" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/SPARQLStore/QueryEngine/DescriptionInterpreters/ConceptDescriptionInterpreter.php#L49-L105", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 3.0.0 before 7.4.1 DoS via Exponential Concept Expansion", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-dos-via-exponential-concept-expansion" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126566.json b/data/2026/126xxx/CVE-2026-126566.json new file mode 100644 index 0000000000..bf2dae69be --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126566.json @@ -0,0 +1,172 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126566", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:43:09.364Z", + "datePublished": "2026-11-11T02:36:04.046Z", + "dateUpdated": "2026-11-11T02:36:04.046Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:36:04.046Z" + }, + "datePublic": "2026-11-10T23:29:39.000Z", + "title": "Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit and move protection logged under the administrator's name." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Incorrect Authorization", + "cweId": "CWE-863", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "7.3.1", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "7.3.1", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 7.1, + "baseSeverity": "HIGH" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "LOW", + "baseScore": 7.1, + "baseSeverity": "HIGH" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-gh59-2vh3-6cgm", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-gh59-2vh3-6cgm)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/32ca6d8fc75735aa7a2ecc573886391da126da9b", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Protection/EditProtectionUpdater.php#L147-L200", + "tags": [ + "technical-description" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/DataUpdater.php#L360-L375", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-7.3.1-before-7.4.1-incorrect-authorization-via-edit-protection-annotations" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126567.json b/data/2026/126xxx/CVE-2026-126567.json new file mode 100644 index 0000000000..805c3318e7 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126567.json @@ -0,0 +1,172 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126567", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T01:43:09.728Z", + "datePublished": "2026-11-11T02:36:04.769Z", + "dateUpdated": "2026-11-11T02:36:04.769Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:36:04.769Z" + }, + "datePublic": "2026-11-10T23:29:42.000Z", + "title": "Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output", + "descriptions": [ + { + "lang": "en", + "value": "Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "SemanticMediaWiki", + "product": "SemanticMediaWiki", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "3.0.0", + "lessThan": "7.4.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "7.4.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:composer/mediawiki/semantic-media-wiki", + "repo": "https://github.com/SemanticMediaWiki/SemanticMediaWiki" + } + ], + "cpeApplicability": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:mediawiki:*:*", + "versionStartIncluding": "3.0.0", + "versionEndExcluding": "7.4.1" + } + ] + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "LOW", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "baseScore": 5.1, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 5.4, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7j96-w9cc-r7rq", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-7j96-w9cc-r7rq)" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/fca9922835f4353e67a71cfef4d527d46e7c3ad3", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1", + "tags": [ + "release-notes" + ], + "name": "SemanticMediaWiki 7.4.1 Release Notes" + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/SpecialAsk.php#L512-L521", + "tags": [ + "technical-description" + ] + }, + { + "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Query/ScoreSet.php#L128-L140", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-special-ask-debug-output" + } + ], + "credits": [ + { + "lang": "en", + "value": "AlpetGexha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126569.json b/data/2026/126xxx/CVE-2026-126569.json new file mode 100644 index 0000000000..abed2c9ed7 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126569.json @@ -0,0 +1,148 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126569", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T02:18:33.812Z", + "datePublished": "2026-11-11T02:36:05.461Z", + "dateUpdated": "2026-11-11T02:36:05.461Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:36:05.461Z" + }, + "datePublic": "2026-11-10T22:49:44.000Z", + "title": "Mbin 1.2.1 before 1.11.1 Stored XSS via Markdown Image Nested in Link", + "descriptions": [ + { + "lang": "en", + "value": "Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "MbinOrg", + "product": "mbin", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "1.2.1", + "lessThan": "1.11.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.11.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:github/MbinOrg/mbin", + "repo": "https://github.com/MbinOrg/mbin" + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "LOW", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "baseScore": 5.1, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 5.4, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/MbinOrg/mbin/security/advisories/GHSA-g3r9-j6w4-2257", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-g3r9-j6w4-2257)" + }, + { + "url": "https://github.com/MbinOrg/mbin/commit/736fd39fe9cd59f5d51636d25e1857d88ddbd0bd", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/MbinOrg/mbin/releases/tag/v1.11.1", + "tags": [ + "release-notes" + ], + "name": "mbin v1.11.1 Release Notes" + }, + { + "url": "https://github.com/MbinOrg/mbin/blob/v1.11.0/src/Markdown/CommonMark/EmbedElement.php#L57-L67", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Mbin 1.2.1 before 1.11.1 Stored XSS via Markdown Image Nested in Link", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/mbin-1.2.1-before-1.11.1-stored-xss-via-markdown-image-nested-in-link" + } + ], + "credits": [ + { + "lang": "en", + "value": "Zachariah Mithani (AploSec)", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126570.json b/data/2026/126xxx/CVE-2026-126570.json new file mode 100644 index 0000000000..1edc4956e1 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126570.json @@ -0,0 +1,147 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126570", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T02:18:34.190Z", + "datePublished": "2026-11-11T02:36:06.228Z", + "dateUpdated": "2026-11-11T02:36:06.228Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:36:06.228Z" + }, + "datePublic": "2026-11-10T10:36:44.000Z", + "title": "Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()", + "descriptions": [ + { + "lang": "en", + "value": "Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", + "cweId": "CWE-1321", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "padloc", + "product": "padloc", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "4.0.0", + "lessThan": "4.3.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "4.3.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:github/padloc/padloc", + "repo": "https://github.com/padloc/padloc" + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "HIGH", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "HIGH", + "baseScore": 7, + "baseSeverity": "HIGH" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "NONE", + "scope": "CHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "HIGH", + "baseScore": 7.6, + "baseSeverity": "HIGH" + } + } + ], + "references": [ + { + "url": "https://github.com/padloc/padloc/security/advisories/GHSA-crhv-mjrg-8vwm", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-crhv-mjrg-8vwm)" + }, + { + "url": "https://github.com/padloc/padloc/commit/7dd3d230ef299c71ac215c802600b5f2358f7ba3", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L421-L428", + "tags": [ + "technical-description" + ] + }, + { + "url": "https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/util.ts#L239-L251", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-prototype-pollution-via-scim-patch-setpath" + } + ], + "credits": [ + { + "lang": "en", + "value": "Zachariah Mithani (AploSec)", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126571.json b/data/2026/126xxx/CVE-2026-126571.json new file mode 100644 index 0000000000..fbc8cc17f1 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126571.json @@ -0,0 +1,141 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126571", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-11T02:18:34.574Z", + "datePublished": "2026-11-11T02:36:06.963Z", + "dateUpdated": "2026-11-11T02:36:06.963Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-11T02:36:06.963Z" + }, + "datePublic": "2026-11-10T10:36:46.000Z", + "title": "Padloc 4.0.0 before 4.3.1 Email MFA Code Brute Force via retrieveMFAToken", + "descriptions": [ + { + "lang": "en", + "value": "Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows." + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improper Restriction of Excessive Authentication Attempts", + "cweId": "CWE-307", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "padloc", + "product": "padloc", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "4.0.0", + "lessThan": "4.3.1", + "status": "affected", + "versionType": "semver" + }, + { + "version": "4.3.1", + "status": "unaffected", + "versionType": "semver" + } + ], + "packageURL": "pkg:github/padloc/padloc", + "repo": "https://github.com/padloc/padloc" + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 6.3, + "baseSeverity": "MEDIUM" + } + }, + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 4.8, + "baseSeverity": "MEDIUM" + } + } + ], + "references": [ + { + "url": "https://github.com/padloc/padloc/security/advisories/GHSA-3mq5-m2qg-fqhq", + "tags": [ + "vendor-advisory" + ], + "name": "GitHub Security Advisory (GHSA-3mq5-m2qg-fqhq)" + }, + { + "url": "https://github.com/padloc/padloc/commit/26f292515fe623826070454872f9cee08b756544", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/v3-compat.ts#L191-L210", + "tags": [ + "technical-description" + ] + }, + { + "name": "VulnCheck Advisory: Padloc 4.0.0 before 4.3.1 Email MFA Code Brute Force via retrieveMFAToken", + "tags": [ + "third-party-advisory" + ], + "url": "https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-email-mfa-code-brute-force-via-retrievemfatoken" + } + ], + "credits": [ + { + "lang": "en", + "value": "Zachariah Mithani (AploSec)", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck-endgame" + } + } + } +} \ No newline at end of file diff --git a/data/2026/33xxx/CVE-2026-33818.json b/data/2026/33xxx/CVE-2026-33818.json index 8f1972250c..b704d92624 100644 --- a/data/2026/33xxx/CVE-2026-33818.json +++ b/data/2026/33xxx/CVE-2026-33818.json @@ -8,14 +8,14 @@ "assignerShortName": "Go", "dateReserved": "2026-03-23T20:35:32.815Z", "datePublished": "2026-08-13T21:58:52.821Z", - "dateUpdated": "2026-11-10T23:21:11.957Z" + "dateUpdated": "2026-11-11T03:13:09.554Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", - "dateUpdated": "2026-11-10T23:21:11.957Z" + "dateUpdated": "2026-11-11T03:13:09.554Z" }, "title": "Enforce maximum recursion depth in encoding/asn1", "descriptions": [ diff --git a/data/2026/42xxx/CVE-2026-42504.json b/data/2026/42xxx/CVE-2026-42504.json index 006b9b89f3..b83d7223a1 100644 --- a/data/2026/42xxx/CVE-2026-42504.json +++ b/data/2026/42xxx/CVE-2026-42504.json @@ -8,14 +8,14 @@ "assignerShortName": "Go", "dateReserved": "2026-04-28T00:21:12.792Z", "datePublished": "2026-06-02T22:01:37.219Z", - "dateUpdated": "2026-11-10T23:21:10.430Z" + "dateUpdated": "2026-11-11T03:13:08.033Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", - "dateUpdated": "2026-11-10T23:21:10.430Z" + "dateUpdated": "2026-11-11T03:13:08.033Z" }, "title": "Quadratic complexity in WordDecoder.DecodeHeader in mime", "descriptions": [ diff --git a/data/2026/62xxx/CVE-2026-62344.json b/data/2026/62xxx/CVE-2026-62344.json index 391fda28a2..61d1d7be30 100644 --- a/data/2026/62xxx/CVE-2026-62344.json +++ b/data/2026/62xxx/CVE-2026-62344.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-07-13T21:42:50.095Z", "datePublished": "2026-11-06T17:55:48.323Z", - "dateUpdated": "2026-11-06T17:55:48.323Z" + "dateUpdated": "2026-11-11T03:15:45.502Z" }, "containers": { "cna": { @@ -100,6 +100,48 @@ "advisory": "GHSA-9qg7-jr2x-prvh", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/open-wanderer/wanderer/security/advisories/GHSA-9qg7-jr2x-prvh", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:15:15.579638Z", + "id": "CVE-2026-62344", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:15:45.502Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/62xxx/CVE-2026-62850.json b/data/2026/62xxx/CVE-2026-62850.json index 71a2d438b5..c3df371cae 100644 --- a/data/2026/62xxx/CVE-2026-62850.json +++ b/data/2026/62xxx/CVE-2026-62850.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T21:10:50.031Z", "datePublished": "2026-11-06T17:04:28.448Z", - "dateUpdated": "2026-11-06T17:04:28.448Z" + "dateUpdated": "2026-11-11T03:12:03.535Z" }, "containers": { "cna": { @@ -113,6 +113,48 @@ "advisory": "GHSA-w2p9-3666-vw9j", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:11:33.664417Z", + "id": "CVE-2026-62850", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:12:03.535Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/62xxx/CVE-2026-62854.json b/data/2026/62xxx/CVE-2026-62854.json index c1fe163fe0..373b51f9a9 100644 --- a/data/2026/62xxx/CVE-2026-62854.json +++ b/data/2026/62xxx/CVE-2026-62854.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T21:10:50.031Z", "datePublished": "2026-11-06T16:50:58.184Z", - "dateUpdated": "2026-11-06T16:50:58.184Z" + "dateUpdated": "2026-11-11T03:10:52.935Z" }, "containers": { "cna": { @@ -100,6 +100,48 @@ "advisory": "GHSA-jpq8-j69f-mj98", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:10:30.333379Z", + "id": "CVE-2026-62854", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:10:52.935Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/63xxx/CVE-2026-63192.json b/data/2026/63xxx/CVE-2026-63192.json new file mode 100644 index 0000000000..854ae09e95 --- /dev/null +++ b/data/2026/63xxx/CVE-2026-63192.json @@ -0,0 +1,87 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-63192", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-15T22:13:00.721Z", + "datePublished": "2026-11-11T02:34:16.495Z", + "dateUpdated": "2026-11-11T02:34:16.495Z" + }, + "containers": { + "cna": { + "title": "Bahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-89", + "lang": "en", + "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-cg9w-r5g6-cxq5", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-cg9w-r5g6-cxq5" + } + ], + "affected": [ + { + "vendor": "Bahmni", + "product": "bahmni-core", + "versions": [ + { + "version": "= 0.93", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T02:34:16.495Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1." + } + ], + "source": { + "advisory": "GHSA-cg9w-r5g6-cxq5", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/63xxx/CVE-2026-63194.json b/data/2026/63xxx/CVE-2026-63194.json new file mode 100644 index 0000000000..672d8926a5 --- /dev/null +++ b/data/2026/63xxx/CVE-2026-63194.json @@ -0,0 +1,87 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-63194", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-15T22:13:00.721Z", + "datePublished": "2026-11-11T02:34:24.288Z", + "dateUpdated": "2026-11-11T02:34:24.288Z" + }, + "containers": { + "cna": { + "title": "Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-22", + "lang": "en", + "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-pmw7-2mfv-4592", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-pmw7-2mfv-4592" + } + ], + "affected": [ + { + "vendor": "Bahmni", + "product": "bahmni-core", + "versions": [ + { + "version": "= 0.93", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T02:34:24.288Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1." + } + ], + "source": { + "advisory": "GHSA-pmw7-2mfv-4592", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/63xxx/CVE-2026-63660.json b/data/2026/63xxx/CVE-2026-63660.json new file mode 100644 index 0000000000..03f4ef4360 --- /dev/null +++ b/data/2026/63xxx/CVE-2026-63660.json @@ -0,0 +1,108 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-63660", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-17T14:47:08.031Z", + "datePublished": "2026-11-11T02:40:47.419Z", + "dateUpdated": "2026-11-11T02:40:47.419Z" + }, + "containers": { + "cna": { + "title": "node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-190", + "lang": "en", + "description": "CWE-190: Integer Overflow or Wraparound", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-787", + "lang": "en", + "description": "CWE-787: Out-of-bounds Write", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj" + }, + { + "name": "https://github.com/mapbox/node-fontnik/pull/202", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/mapbox/node-fontnik/pull/202" + }, + { + "name": "https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7" + } + ], + "affected": [ + { + "vendor": "mapbox", + "product": "node-fontnik", + "versions": [ + { + "version": "< 0.7.7", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T02:40:47.419Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7." + } + ], + "source": { + "advisory": "GHSA-cfm6-c7rv-58xj", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/64xxx/CVE-2026-64894.json b/data/2026/64xxx/CVE-2026-64894.json index 2ff6400935..9cde24e84a 100644 --- a/data/2026/64xxx/CVE-2026-64894.json +++ b/data/2026/64xxx/CVE-2026-64894.json @@ -8,7 +8,7 @@ "assignerShortName": "jci", "dateReserved": "2026-07-20T19:51:19.089Z", "datePublished": "2026-11-06T14:12:23.537Z", - "dateUpdated": "2026-11-06T14:12:23.537Z" + "dateUpdated": "2026-11-11T02:57:03.693Z" }, "containers": { "cna": { @@ -112,6 +112,40 @@ "x_generator": { "engine": "Vulnogram 1.0.5" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T02:55:24.206169Z", + "id": "CVE-2026-64894", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T02:57:03.693Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/85xxx/CVE-2026-85743.json b/data/2026/85xxx/CVE-2026-85743.json index 2fbd91bc69..998179849f 100644 --- a/data/2026/85xxx/CVE-2026-85743.json +++ b/data/2026/85xxx/CVE-2026-85743.json @@ -8,7 +8,7 @@ "assignerShortName": "GitHub_M", "dateReserved": "2026-09-04T14:50:16.720Z", "datePublished": "2026-11-06T17:06:26.940Z", - "dateUpdated": "2026-11-06T17:06:26.940Z" + "dateUpdated": "2026-11-11T03:13:02.881Z" }, "containers": { "cna": { @@ -100,6 +100,48 @@ "advisory": "GHSA-6w8v-qp43-vg2h", "discovery": "UNKNOWN" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:12:34.893833Z", + "id": "CVE-2026-85743", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:13:02.881Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/89xxx/CVE-2026-89017.json b/data/2026/89xxx/CVE-2026-89017.json index 1022203509..8cc9b368a9 100644 --- a/data/2026/89xxx/CVE-2026-89017.json +++ b/data/2026/89xxx/CVE-2026-89017.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-09-10T16:23:54.471Z", "datePublished": "2026-11-06T17:50:47.441Z", - "dateUpdated": "2026-11-06T17:50:47.441Z" + "dateUpdated": "2026-11-11T03:14:46.350Z" }, "containers": { "cna": { @@ -161,6 +161,40 @@ "x_generator": { "engine": "vulncheck" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T03:14:36.137146Z", + "id": "CVE-2026-89017", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T03:14:46.350Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/96xxx/CVE-2026-96275.json b/data/2026/96xxx/CVE-2026-96275.json index 4357d0e3c1..a98920aff3 100644 --- a/data/2026/96xxx/CVE-2026-96275.json +++ b/data/2026/96xxx/CVE-2026-96275.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-22T20:42:17.038Z", "datePublished": "2026-09-23T15:01:38.344Z", - "dateUpdated": "2026-11-11T01:45:35.692Z" + "dateUpdated": "2026-11-11T03:10:26.245Z" }, "containers": { "cna": { @@ -179,6 +179,44 @@ "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.12.9-1.el8_8.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:rhel_e4s:8.8::appstream", + "cpe:/a:redhat:rhel_tus:8.8::appstream" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.12.9-1.el8_8.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:rhel_e4s:8.8::appstream", + "cpe:/a:redhat:rhel_tus:8.8::appstream" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", @@ -337,6 +375,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98127", + "name": "RHSA-2026:98127", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96275", "tags": [ @@ -397,7 +443,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T01:45:35.692Z" + "dateUpdated": "2026-11-11T03:10:26.245Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/96xxx/CVE-2026-96280.json b/data/2026/96xxx/CVE-2026-96280.json index fbb7b370b0..ea60035c1b 100644 --- a/data/2026/96xxx/CVE-2026-96280.json +++ b/data/2026/96xxx/CVE-2026-96280.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-22T20:43:35.900Z", "datePublished": "2026-09-27T20:19:12.890Z", - "dateUpdated": "2026-11-11T01:45:53.914Z" + "dateUpdated": "2026-11-11T03:10:34.489Z" }, "containers": { "cna": { @@ -179,6 +179,44 @@ "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.12.9-1.el8_8.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:rhel_e4s:8.8::appstream", + "cpe:/a:redhat:rhel_tus:8.8::appstream" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.12.9-1.el8_8.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:rhel_e4s:8.8::appstream", + "cpe:/a:redhat:rhel_tus:8.8::appstream" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", @@ -337,6 +375,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98127", + "name": "RHSA-2026:98127", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96280", "tags": [ @@ -397,7 +443,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T01:45:53.914Z" + "dateUpdated": "2026-11-11T03:10:34.489Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/97xxx/CVE-2026-97033.json b/data/2026/97xxx/CVE-2026-97033.json new file mode 100644 index 0000000000..498b16fe27 --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97033.json @@ -0,0 +1,76 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97033", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:04:33.594Z", + "datePublished": "2026-11-11T03:13:17.601Z", + "dateUpdated": "2026-11-11T03:13:17.601Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:17.601Z" + }, + "title": "Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go", + "descriptions": [ + { + "lang": "en", + "value": "Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in \"#cgo\" directives. Specifically, \"--sysroot\" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; \"-target\" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; \"-isysroot\" and \"-Wl,-syslibroot\" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and \"-x\" permitted specifying arbitrary compiler input languages beyond those supported by cgo. \"--sysroot\" and \"-target\" are now disallowed in \"#cgo\" flags, \"-isysroot\" and \"-Wl,-syslibroot\" are verified not to point to regular files, and \"-x\" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862146" + }, + { + "url": "https://go.dev/issue/82577" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6858" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97034.json b/data/2026/97xxx/CVE-2026-97034.json new file mode 100644 index 0000000000..f62d79daa8 --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97034.json @@ -0,0 +1,76 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97034", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:04:46.550Z", + "datePublished": "2026-11-11T03:13:17.194Z", + "dateUpdated": "2026-11-11T03:13:17.194Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:17.194Z" + }, + "title": "Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go", + "descriptions": [ + { + "lang": "en", + "value": "When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files (\"specs\" or \"*.spec\"). When linking with \"-fopenmp\", \"-fopenacc\", or \"-fsanitize=\" in \"#cgo LDFLAGS\", GCC's built-in link spec evaluates \"%:include(libgomp.spec)\" or \"%:include(libsanitizer.spec)\" and searches for spec files in \"-L\" and sysroot directories (including subdirectories and multilib sibling directories such as \"../lib64\"), as well as the working directory when \"-fopenmp\" or \"-fopenacc\" is used or when \"-fsanitize=\" is combined with \"-static\" or \"-static-lib*\". The go command now rejects \"-L\", \"-isysroot\", and \"-Wl,-syslibroot\" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows \"@\" and \"-\" prefixes in \"-fsanitize=\" compiler flag values." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862147" + }, + { + "url": "https://go.dev/issue/82576" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6857" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97035.json b/data/2026/97xxx/CVE-2026-97035.json new file mode 100644 index 0000000000..0d6267aee1 --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97035.json @@ -0,0 +1,76 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97035", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.987Z", + "datePublished": "2026-11-11T03:13:16.798Z", + "dateUpdated": "2026-11-11T03:13:16.798Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:16.798Z" + }, + "title": "Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go", + "descriptions": [ + { + "lang": "en", + "value": "When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via \"-gen-*\" or \"-gnat*\" flags in \"#cgo\" directives. The \"-g*\" wildcard in the compiler and linker flag allowlists previously matched Clang's two-argument \"-gen-cdb-fragment-path \" flag and GCC's two-argument \"-gnatO \" flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker. \"-gen-*\" and \"-gnat*\" flags are now disallowed in \"#cgo\" compiler and linker flags." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862148" + }, + { + "url": "https://go.dev/issue/82575" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6856" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97036.json b/data/2026/97xxx/CVE-2026-97036.json new file mode 100644 index 0000000000..0c616e0d7f --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97036.json @@ -0,0 +1,85 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97036", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.987Z", + "datePublished": "2026-11-11T03:13:16.347Z", + "dateUpdated": "2026-11-11T03:13:16.347Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:16.347Z" + }, + "title": "Arbitrary code execution during build on darwin via \"-l to_library\" in cgo in cmd/go", + "descriptions": [ + { + "lang": "en", + "value": "On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing \"-l to_library \" in a \"#cgo LDFLAGS\" directive. The Apple linker recombines the separated arguments \"-l\" and \"to_library\" into \"-lto_library\", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows \"-l\" followed by \"to_library\" in \"#cgo LDFLAGS\", rejects \"-lazy_library\", \"-lazy_framework\", \"-load_hidden\", \"-library\", and \"-library-path\", and checks recombined \"-l\" arguments against disallowed linker flags and patterns." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "platforms": [ + "darwin" + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862149" + }, + { + "url": "https://go.dev/issue/82574" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6855" + } + ], + "credits": [ + { + "lang": "en", + "value": "Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97037.json b/data/2026/97xxx/CVE-2026-97037.json new file mode 100644 index 0000000000..ee55121809 --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97037.json @@ -0,0 +1,76 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97037", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.987Z", + "datePublished": "2026-11-11T03:13:16.142Z", + "dateUpdated": "2026-11-11T03:13:16.142Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:16.142Z" + }, + "title": "Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go", + "descriptions": [ + { + "lang": "en", + "value": "Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via \"#cgo LDFLAGS\". Split \"-Wl,\" flags that consume a following argument (such as \"-Wl,-rpath\", \"-Wl,--just-symbols\", and \"-Wl,-undefined\") previously accepted a bare second argument without a \"-Wl,\" prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as \"-framework\", \"-Wl,-framework\", \"-Wl,-undefined\", \"-Wl,--just-symbols\", \"-Wl,-R\", \"-Wl,-subsystem\", and (on non-Darwin platforms) \"-Wl,-sectcreate\" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk. The go command now requires a \"-Wl,\" prefix on the second token of split \"-Wl,\" flags (except \"-Wl,-R\"), verifies that these flags do not reference linker script files, and disallows bare \"-Wl,--warn-backrefs-exclude\"." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862150" + }, + { + "url": "https://go.dev/issue/82573" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6854" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97038.json b/data/2026/97xxx/CVE-2026-97038.json new file mode 100644 index 0000000000..972a6d399c --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97038.json @@ -0,0 +1,76 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97038", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.987Z", + "datePublished": "2026-11-11T03:13:15.930Z", + "dateUpdated": "2026-11-11T03:13:15.930Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:15.930Z" + }, + "title": "Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go", + "descriptions": [ + { + "lang": "en", + "value": "Building a malicious package containing \".syso\" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including \".syso\" files, direct object or library inputs in \"#cgo LDFLAGS\", and libraries in \"-L\" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or \".syso\" files (or loaded via \"-l:\" or \"-l\" containing path separators), injecting unallowlisted linker flags via PE/COFF \".drectve\" sections on Windows or Mach-O \"LC_LINKER_OPTION\" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that \".syso\" files, direct linker inputs, and libraries in \"-L\" directories are valid binary objects or archives that do not contain unallowlisted \".drectve\" directives, \"LC_LINKER_OPTION\" load commands, or LTO IR sections, and disallows \"-l:\" and \":\", \"=\", or path separators in \"-l\" flags." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862151" + }, + { + "url": "https://go.dev/issue/82572" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6853" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97039.json b/data/2026/97xxx/CVE-2026-97039.json new file mode 100644 index 0000000000..53fe0f237b --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97039.json @@ -0,0 +1,76 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97039", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.987Z", + "datePublished": "2026-11-11T03:13:15.684Z", + "dateUpdated": "2026-11-11T03:13:15.684Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:15.684Z" + }, + "title": "Flag sanitization bypass via \"#cgo pkg-config:\" directives in cmd/go", + "descriptions": [ + { + "lang": "en", + "value": "Building a malicious package that uses \"#cgo pkg-config:\" directives could load untrusted pkg-config \".pc\" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted \"--with-path=\" and \"--personality=\", allowed \"--define-variable=\" values beginning with \"=\" or \"$\" (which can rewrite paths in system \".pc\" files into sysroot-prefixed \"-L=\" or \"-L$SYSROOT\" linker search paths), and allowed package arguments ending in \".pc\" or containing path separators or \"..\", which caused pkg-config to load local \".pc\" files directly from the package directory. In addition, flags returned by \"pkg-config --cflags\" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows \"--with-path=\", \"--personality=\", leading \"=\" or \"$\" characters in \"--define-variable=\" values, and local \".pc\" paths in \"#cgo pkg-config:\" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862152" + }, + { + "url": "https://go.dev/issue/82571" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6852" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97040.json b/data/2026/97xxx/CVE-2026-97040.json new file mode 100644 index 0000000000..00bd8e227d --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97040.json @@ -0,0 +1,103 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97040", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.987Z", + "datePublished": "2026-11-11T03:13:15.477Z", + "dateUpdated": "2026-11-11T03:13:15.477Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:15.477Z" + }, + "title": "Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link", + "descriptions": [ + { + "lang": "en", + "value": "Building a package containing a crafted \".syso\" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading \".syso\" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A \".syso\" file beginning with a \"go object\" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as \"cgo_ldflag\" or \"cgo_dynamic_linker\") embedded in the \".syso\" file to be passed to the external linker without validation. Additionally, \".syso\" filenames longer than 16 bytes lost their \".syso\" extension when truncated in archive headers, and unrecognized \".syso\" formats forced external linking in pure-Go builds. The linker now rejects \".syso\" files that are not recognized host object formats, and \"cmd/go\" and \"cmd/pack\" preserve the \".syso\" suffix when truncating long archive member names." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + }, + { + "vendor": "Go toolchain", + "product": "cmd/link", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/link", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862153" + }, + { + "url": "https://go.dev/issue/82570" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6851" + } + ], + "credits": [ + { + "lang": "en", + "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc." + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97041.json b/data/2026/97xxx/CVE-2026-97041.json new file mode 100644 index 0000000000..059b44c814 --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97041.json @@ -0,0 +1,103 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97041", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.987Z", + "datePublished": "2026-11-11T03:13:15.269Z", + "dateUpdated": "2026-11-11T03:13:15.269Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:15.269Z" + }, + "title": "Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link", + "descriptions": [ + { + "lang": "en", + "value": "Building a malicious package containing \"//go:cgo_*\" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in \"//go:cgo_import_dynamic\", \"//go:cgo_export_dynamic\", \"//go:cgo_export_static\", \"//go:cgo_import_static\", and \"//go:cgo_dynamic_linker\" directives, and the linker passed the dynamic linker path using \"-Wl,--dynamic-linker,\". Furthermore, the two-argument form of \"//go:cgo_import_dynamic\" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading \"@\" could split \"-Wl,--export-dynamic-symbol=\" or \"-Wl,--dynamic-linker,\" into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in \"//go:cgo_*\" symbol and dynamic linker directives, the linker passes \"-Wl,--dynamic-linker=\", and \"cgo_import_dynamic\" no longer overwrites symbols exported via \"cgo_export_dynamic\" or \"cgo_export_static\"." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/compile", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/compile", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + }, + { + "vendor": "Go toolchain", + "product": "cmd/link", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/link", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862154" + }, + { + "url": "https://go.dev/issue/82569" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6850" + } + ], + "credits": [ + { + "lang": "en", + "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc." + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97042.json b/data/2026/97xxx/CVE-2026-97042.json new file mode 100644 index 0000000000..4e94cea41f --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97042.json @@ -0,0 +1,118 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97042", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.987Z", + "datePublished": "2026-11-11T03:13:15.060Z", + "dateUpdated": "2026-11-11T03:13:15.060Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:15.060Z" + }, + "title": "Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link", + "descriptions": [ + { + "lang": "en", + "value": "Building a malicious package that uses \"//go:cgo_import_dynamic\" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in \"//go:cgo_import_dynamic\" directives and skipped validation in cgo-generated files. In addition, on Windows, \"cmd/cgo\" and \"cmd/link\" did not validate imported DLL names extracted from PE object files before emitting \"-l\" flags for the external linker, allowing a crafted DLL name containing \"..\" path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in \"//go:cgo_import_dynamic\" directives (including in cgo-generated files on Windows) and rejects \"..\" path traversal, and \"cmd/cgo\" and \"cmd/link\" reject PE imported DLL names containing path separators, \"..\", \":\", or leading \"-\" or \"@\"." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/cgo", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/cgo", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + }, + { + "vendor": "Go toolchain", + "product": "cmd/compile", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/compile", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + }, + { + "vendor": "Go toolchain", + "product": "cmd/link", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/link", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862155" + }, + { + "url": "https://go.dev/issue/82568" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6849" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97043.json b/data/2026/97xxx/CVE-2026-97043.json new file mode 100644 index 0000000000..16ffe260e3 --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97043.json @@ -0,0 +1,97 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97043", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.988Z", + "datePublished": "2026-11-11T03:13:14.827Z", + "dateUpdated": "2026-11-11T03:13:14.827Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:14.827Z" + }, + "title": "Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile", + "descriptions": [ + { + "lang": "en", + "value": "Building a malicious package that uses cgo could bypass \"#cgo LDFLAGS\" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in \"//go:cgo_ldflag\" directives. When \"cmd/cgo\" generates \"_cgo_gotypes.go\", it quotes each \"#cgo LDFLAGS\" argument with strconv.Quote in a \"//go:cgo_ldflag\" directive, but \"cmd/compile\" and \"cmd/go\" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice. \"cmd/compile\" and \"cmd/go\" now properly handle backslash-escaped quotes and unquote \"//go:cgo_*\" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed." + } + ], + "affected": [ + { + "vendor": "Go toolchain", + "product": "cmd/go", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/go", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + }, + { + "vendor": "Go toolchain", + "product": "cmd/compile", + "collectionURL": "https://pkg.go.dev", + "packageName": "cmd/compile", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862156" + }, + { + "url": "https://go.dev/issue/82567" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6848" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/97xxx/CVE-2026-97054.json b/data/2026/97xxx/CVE-2026-97054.json new file mode 100644 index 0000000000..55066c81e0 --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97054.json @@ -0,0 +1,531 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97054", + "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "state": "PUBLISHED", + "assignerShortName": "Go", + "dateReserved": "2026-09-23T23:05:04.988Z", + "datePublished": "2026-11-11T03:13:17.877Z", + "dateUpdated": "2026-11-11T03:13:17.877Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", + "shortName": "Go", + "dateUpdated": "2026-11-11T03:13:17.877Z" + }, + "title": "HTTP/1 server crash due to MaxBytesReader header race in net/http", + "descriptions": [ + { + "lang": "en", + "value": "For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header." + } + ], + "affected": [ + { + "vendor": "Go standard library", + "product": "net/http", + "collectionURL": "https://pkg.go.dev", + "packageName": "net/http", + "versions": [ + { + "version": "0", + "lessThan": "1.26.11", + "status": "affected", + "versionType": "semver" + }, + { + "version": "1.27.0-0", + "lessThan": "1.27.4", + "status": "affected", + "versionType": "semver" + } + ], + "programRoutines": [ + { + "name": "maxBytesReader.Read" + }, + { + "name": "CanonicalHeaderKey" + }, + { + "name": "Client.CloseIdleConnections" + }, + { + "name": "Client.Do" + }, + { + "name": "Client.Get" + }, + { + "name": "Client.Head" + }, + { + "name": "Client.Post" + }, + { + "name": "Client.PostForm" + }, + { + "name": "ClientConn.Close" + }, + { + "name": "ClientConn.RoundTrip" + }, + { + "name": "Cookie.String" + }, + { + "name": "Cookie.Valid" + }, + { + "name": "CrossOriginProtection.AddInsecureBypassPattern" + }, + { + "name": "CrossOriginProtection.AddTrustedOrigin" + }, + { + "name": "CrossOriginProtection.Check" + }, + { + "name": "Dir.Open" + }, + { + "name": "Error" + }, + { + "name": "Get" + }, + { + "name": "Handle" + }, + { + "name": "HandleFunc" + }, + { + "name": "HandlerFunc.ServeHTTP" + }, + { + "name": "Head" + }, + { + "name": "Header.Add" + }, + { + "name": "Header.Del" + }, + { + "name": "Header.Get" + }, + { + "name": "Header.Set" + }, + { + "name": "Header.Values" + }, + { + "name": "Header.Write" + }, + { + "name": "Header.WriteSubset" + }, + { + "name": "ListenAndServe" + }, + { + "name": "ListenAndServeTLS" + }, + { + "name": "NewRequest" + }, + { + "name": "NewRequestWithContext" + }, + { + "name": "NotFound" + }, + { + "name": "ParseCookie" + }, + { + "name": "ParseSetCookie" + }, + { + "name": "ParseTime" + }, + { + "name": "Post" + }, + { + "name": "PostForm" + }, + { + "name": "ProxyFromEnvironment" + }, + { + "name": "ReadRequest" + }, + { + "name": "ReadResponse" + }, + { + "name": "Redirect" + }, + { + "name": "Request.AddCookie" + }, + { + "name": "Request.BasicAuth" + }, + { + "name": "Request.Cookie" + }, + { + "name": "Request.Cookies" + }, + { + "name": "Request.CookiesNamed" + }, + { + "name": "Request.FormFile" + }, + { + "name": "Request.FormValue" + }, + { + "name": "Request.MultipartReader" + }, + { + "name": "Request.ParseForm" + }, + { + "name": "Request.ParseMultipartForm" + }, + { + "name": "Request.PostFormValue" + }, + { + "name": "Request.Referer" + }, + { + "name": "Request.SetBasicAuth" + }, + { + "name": "Request.UserAgent" + }, + { + "name": "Request.Write" + }, + { + "name": "Request.WriteProxy" + }, + { + "name": "Response.Cookies" + }, + { + "name": "Response.Location" + }, + { + "name": "Response.Write" + }, + { + "name": "ResponseController.EnableFullDuplex" + }, + { + "name": "ResponseController.Flush" + }, + { + "name": "ResponseController.Hijack" + }, + { + "name": "ResponseController.SetReadDeadline" + }, + { + "name": "ResponseController.SetWriteDeadline" + }, + { + "name": "Serve" + }, + { + "name": "ServeContent" + }, + { + "name": "ServeFile" + }, + { + "name": "ServeFileFS" + }, + { + "name": "ServeMux.Handle" + }, + { + "name": "ServeMux.HandleFunc" + }, + { + "name": "ServeMux.ServeHTTP" + }, + { + "name": "ServeTLS" + }, + { + "name": "Server.Close" + }, + { + "name": "Server.ListenAndServe" + }, + { + "name": "Server.ListenAndServeTLS" + }, + { + "name": "Server.Serve" + }, + { + "name": "Server.ServeTLS" + }, + { + "name": "Server.SetKeepAlivesEnabled" + }, + { + "name": "Server.Shutdown" + }, + { + "name": "SetCookie" + }, + { + "name": "Transport.CancelRequest" + }, + { + "name": "Transport.Clone" + }, + { + "name": "Transport.CloseIdleConnections" + }, + { + "name": "Transport.NewClientConn" + }, + { + "name": "Transport.RoundTrip" + }, + { + "name": "body.Close" + }, + { + "name": "body.Read" + }, + { + "name": "bodyEOFSignal.Close" + }, + { + "name": "bodyEOFSignal.Read" + }, + { + "name": "bodyLocked.Read" + }, + { + "name": "bufioFlushWriter.Write" + }, + { + "name": "cancelTimerBody.Close" + }, + { + "name": "cancelTimerBody.Read" + }, + { + "name": "checkConnErrorWriter.Write" + }, + { + "name": "chunkWriter.Write" + }, + { + "name": "connReader.Read" + }, + { + "name": "connectMethodKey.String" + }, + { + "name": "expectContinueReader.Close" + }, + { + "name": "expectContinueReader.Read" + }, + { + "name": "extraHeader.Write" + }, + { + "name": "fileHandler.ServeHTTP" + }, + { + "name": "fileTransport.RoundTrip" + }, + { + "name": "globalOptionsHandler.ServeHTTP" + }, + { + "name": "gzipReader.Close" + }, + { + "name": "gzipReader.Read" + }, + { + "name": "http1ClientConn.Close" + }, + { + "name": "http1ClientConn.RoundTrip" + }, + { + "name": "http2ClientConn.RoundTrip" + }, + { + "name": "http2Handler.ServeHTTP" + }, + { + "name": "http2ResponseWriter.Flush" + }, + { + "name": "http2ResponseWriter.FlushError" + }, + { + "name": "http2ResponseWriter.Push" + }, + { + "name": "http2RoundTripper.RoundTrip" + }, + { + "name": "http3ServerHandler.ServeHTTP" + }, + { + "name": "initALPNRequest.ServeHTTP" + }, + { + "name": "loggingConn.Close" + }, + { + "name": "loggingConn.Read" + }, + { + "name": "loggingConn.Write" + }, + { + "name": "maxBytesReader.Close" + }, + { + "name": "onceCloseListener.Close" + }, + { + "name": "persistConn.Read" + }, + { + "name": "persistConnWriter.ReadFrom" + }, + { + "name": "persistConnWriter.Write" + }, + { + "name": "populateResponse.Write" + }, + { + "name": "populateResponse.WriteHeader" + }, + { + "name": "readTrackingBody.Close" + }, + { + "name": "readTrackingBody.Read" + }, + { + "name": "readWriteCloserBody.CloseWrite" + }, + { + "name": "readWriteCloserBody.Read" + }, + { + "name": "redirectHandler.ServeHTTP" + }, + { + "name": "response.Flush" + }, + { + "name": "response.FlushError" + }, + { + "name": "response.Hijack" + }, + { + "name": "response.ReadFrom" + }, + { + "name": "response.Write" + }, + { + "name": "response.WriteHeader" + }, + { + "name": "response.WriteString" + }, + { + "name": "serverHandler.ServeHTTP" + }, + { + "name": "socksDialer.DialWithConn" + }, + { + "name": "socksUsernamePassword.Authenticate" + }, + { + "name": "stringWriter.WriteString" + }, + { + "name": "timeoutHandler.ServeHTTP" + }, + { + "name": "timeoutWriter.Write" + }, + { + "name": "timeoutWriter.WriteHeader" + }, + { + "name": "transportReadFromServerError.Error" + }, + { + "name": "unencryptedHTTP2Request.ServeHTTP" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-820: Missing Synchronization" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/cl/862185" + }, + { + "url": "https://go.dev/issue/82563" + }, + { + "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-6859" + } + ], + "credits": [ + { + "lang": "en", + "value": "Jakub Ciolek (https://ciolek.dev)" + } + ] + } + } +} \ No newline at end of file diff --git a/data/delta.json b/data/delta.json index ad3ec479ba..dab8db67fd 100644 --- a/data/delta.json +++ b/data/delta.json @@ -1,13 +1,176 @@ { - "fetchTime": "2026-11-11T01:52:58.165Z", - "numberOfChanges": 1, - "new": [], + "fetchTime": "2026-11-11T03:17:12.413Z", + "numberOfChanges": 28, + "new": [ + { + "cveId": "CVE-2026-97033", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97033", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97033.json", + "dateUpdated": "2026-11-11T03:13:17.601Z" + }, + { + "cveId": "CVE-2026-97034", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97034", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97034.json", + "dateUpdated": "2026-11-11T03:13:17.194Z" + }, + { + "cveId": "CVE-2026-97035", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97035", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97035.json", + "dateUpdated": "2026-11-11T03:13:16.798Z" + }, + { + "cveId": "CVE-2026-97036", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97036", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97036.json", + "dateUpdated": "2026-11-11T03:13:16.347Z" + }, + { + "cveId": "CVE-2026-97037", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97037", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97037.json", + "dateUpdated": "2026-11-11T03:13:16.142Z" + }, + { + "cveId": "CVE-2026-97038", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97038", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97038.json", + "dateUpdated": "2026-11-11T03:13:15.930Z" + }, + { + "cveId": "CVE-2026-97039", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97039", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97039.json", + "dateUpdated": "2026-11-11T03:13:15.684Z" + }, + { + "cveId": "CVE-2026-97040", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97040", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97040.json", + "dateUpdated": "2026-11-11T03:13:15.477Z" + }, + { + "cveId": "CVE-2026-97041", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97041", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97041.json", + "dateUpdated": "2026-11-11T03:13:15.269Z" + }, + { + "cveId": "CVE-2026-97042", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97042", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97042.json", + "dateUpdated": "2026-11-11T03:13:15.060Z" + }, + { + "cveId": "CVE-2026-97043", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97043", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97043.json", + "dateUpdated": "2026-11-11T03:13:14.827Z" + }, + { + "cveId": "CVE-2026-97054", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97054", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97054.json", + "dateUpdated": "2026-11-11T03:13:17.877Z" + } + ], "updated": [ { - "cveId": "CVE-2026-114406", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114406", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114406.json", - "dateUpdated": "2026-11-11T01:48:44.517Z" + "cveId": "CVE-2026-102359", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102359", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102359.json", + "dateUpdated": "2026-11-11T03:13:53.054Z" + }, + { + "cveId": "CVE-2026-108262", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108262", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108262.json", + "dateUpdated": "2026-11-11T03:16:39.472Z" + }, + { + "cveId": "CVE-2026-118515", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118515", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118515.json", + "dateUpdated": "2026-11-11T03:10:02.952Z" + }, + { + "cveId": "CVE-2026-123622", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123622", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123622.json", + "dateUpdated": "2026-11-11T03:05:29.613Z" + }, + { + "cveId": "CVE-2026-123623", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123623", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123623.json", + "dateUpdated": "2026-11-11T03:07:33.112Z" + }, + { + "cveId": "CVE-2026-123676", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123676", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123676.json", + "dateUpdated": "2026-11-11T03:08:22.186Z" + }, + { + "cveId": "CVE-2026-123784", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123784", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123784.json", + "dateUpdated": "2026-11-11T03:06:39.965Z" + }, + { + "cveId": "CVE-2026-33818", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-33818", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33818.json", + "dateUpdated": "2026-11-11T03:13:09.554Z" + }, + { + "cveId": "CVE-2026-42504", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42504", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42504.json", + "dateUpdated": "2026-11-11T03:13:08.033Z" + }, + { + "cveId": "CVE-2026-62344", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-62344", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62344.json", + "dateUpdated": "2026-11-11T03:15:45.502Z" + }, + { + "cveId": "CVE-2026-62850", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-62850", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62850.json", + "dateUpdated": "2026-11-11T03:12:03.535Z" + }, + { + "cveId": "CVE-2026-62854", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-62854", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62854.json", + "dateUpdated": "2026-11-11T03:10:52.935Z" + }, + { + "cveId": "CVE-2026-85743", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85743", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85743.json", + "dateUpdated": "2026-11-11T03:13:02.881Z" + }, + { + "cveId": "CVE-2026-89017", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89017", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89017.json", + "dateUpdated": "2026-11-11T03:14:46.350Z" + }, + { + "cveId": "CVE-2026-96275", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96275", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96275.json", + "dateUpdated": "2026-11-11T03:10:26.245Z" + }, + { + "cveId": "CVE-2026-96280", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96280", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96280.json", + "dateUpdated": "2026-11-11T03:10:34.489Z" } ], "error": [] diff --git a/data/deltaLog.json b/data/deltaLog.json index 6542786081..857e52c149 100644 --- a/data/deltaLog.json +++ b/data/deltaLog.json @@ -1,4 +1,378 @@ [ + { + "fetchTime": "2026-11-11T03:17:12.413Z", + "numberOfChanges": 28, + "new": [ + { + "cveId": "CVE-2026-97033", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97033", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97033.json", + "dateUpdated": "2026-11-11T03:13:17.601Z" + }, + { + "cveId": "CVE-2026-97034", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97034", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97034.json", + "dateUpdated": "2026-11-11T03:13:17.194Z" + }, + { + "cveId": "CVE-2026-97035", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97035", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97035.json", + "dateUpdated": "2026-11-11T03:13:16.798Z" + }, + { + "cveId": "CVE-2026-97036", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97036", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97036.json", + "dateUpdated": "2026-11-11T03:13:16.347Z" + }, + { + "cveId": "CVE-2026-97037", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97037", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97037.json", + "dateUpdated": "2026-11-11T03:13:16.142Z" + }, + { + "cveId": "CVE-2026-97038", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97038", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97038.json", + "dateUpdated": "2026-11-11T03:13:15.930Z" + }, + { + "cveId": "CVE-2026-97039", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97039", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97039.json", + "dateUpdated": "2026-11-11T03:13:15.684Z" + }, + { + "cveId": "CVE-2026-97040", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97040", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97040.json", + "dateUpdated": "2026-11-11T03:13:15.477Z" + }, + { + "cveId": "CVE-2026-97041", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97041", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97041.json", + "dateUpdated": "2026-11-11T03:13:15.269Z" + }, + { + "cveId": "CVE-2026-97042", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97042", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97042.json", + "dateUpdated": "2026-11-11T03:13:15.060Z" + }, + { + "cveId": "CVE-2026-97043", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97043", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97043.json", + "dateUpdated": "2026-11-11T03:13:14.827Z" + }, + { + "cveId": "CVE-2026-97054", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97054", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97054.json", + "dateUpdated": "2026-11-11T03:13:17.877Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-102359", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102359", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102359.json", + "dateUpdated": "2026-11-11T03:13:53.054Z" + }, + { + "cveId": "CVE-2026-108262", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108262", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108262.json", + "dateUpdated": "2026-11-11T03:16:39.472Z" + }, + { + "cveId": "CVE-2026-118515", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118515", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118515.json", + "dateUpdated": "2026-11-11T03:10:02.952Z" + }, + { + "cveId": "CVE-2026-123622", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123622", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123622.json", + "dateUpdated": "2026-11-11T03:05:29.613Z" + }, + { + "cveId": "CVE-2026-123623", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123623", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123623.json", + "dateUpdated": "2026-11-11T03:07:33.112Z" + }, + { + "cveId": "CVE-2026-123676", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123676", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123676.json", + "dateUpdated": "2026-11-11T03:08:22.186Z" + }, + { + "cveId": "CVE-2026-123784", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123784", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123784.json", + "dateUpdated": "2026-11-11T03:06:39.965Z" + }, + { + "cveId": "CVE-2026-33818", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-33818", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33818.json", + "dateUpdated": "2026-11-11T03:13:09.554Z" + }, + { + "cveId": "CVE-2026-42504", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42504", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42504.json", + "dateUpdated": "2026-11-11T03:13:08.033Z" + }, + { + "cveId": "CVE-2026-62344", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-62344", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62344.json", + "dateUpdated": "2026-11-11T03:15:45.502Z" + }, + { + "cveId": "CVE-2026-62850", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-62850", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62850.json", + "dateUpdated": "2026-11-11T03:12:03.535Z" + }, + { + "cveId": "CVE-2026-62854", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-62854", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62854.json", + "dateUpdated": "2026-11-11T03:10:52.935Z" + }, + { + "cveId": "CVE-2026-85743", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85743", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85743.json", + "dateUpdated": "2026-11-11T03:13:02.881Z" + }, + { + "cveId": "CVE-2026-89017", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89017", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89017.json", + "dateUpdated": "2026-11-11T03:14:46.350Z" + }, + { + "cveId": "CVE-2026-96275", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96275", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96275.json", + "dateUpdated": "2026-11-11T03:10:26.245Z" + }, + { + "cveId": "CVE-2026-96280", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96280", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96280.json", + "dateUpdated": "2026-11-11T03:10:34.489Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T03:04:31.775Z", + "numberOfChanges": 6, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-106019", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106019", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106019.json", + "dateUpdated": "2026-11-11T02:57:47.750Z" + }, + { + "cveId": "CVE-2026-112335", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112335", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112335.json", + "dateUpdated": "2026-11-11T02:58:54.636Z" + }, + { + "cveId": "CVE-2026-112339", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112339", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112339.json", + "dateUpdated": "2026-11-11T03:00:14.774Z" + }, + { + "cveId": "CVE-2026-123486", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123486", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123486.json", + "dateUpdated": "2026-11-11T03:01:33.272Z" + }, + { + "cveId": "CVE-2026-123490", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123490", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123490.json", + "dateUpdated": "2026-11-11T03:02:28.975Z" + }, + { + "cveId": "CVE-2026-123618", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123618", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123618.json", + "dateUpdated": "2026-11-11T03:03:36.682Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T02:57:12.239Z", + "numberOfChanges": 1, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-64894", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-64894", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/64xxx/CVE-2026-64894.json", + "dateUpdated": "2026-11-11T02:57:03.693Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T02:51:04.948Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2026-116645", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116645", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116645.json", + "dateUpdated": "2026-11-11T02:50:53.016Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T02:45:15.963Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2026-63660", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-63660", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63660.json", + "dateUpdated": "2026-11-11T02:40:47.419Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T02:39:14.004Z", + "numberOfChanges": 17, + "new": [ + { + "cveId": "CVE-2026-126559", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126559", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126559.json", + "dateUpdated": "2026-11-11T02:35:56.604Z" + }, + { + "cveId": "CVE-2026-126560", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126560", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126560.json", + "dateUpdated": "2026-11-11T02:35:57.283Z" + }, + { + "cveId": "CVE-2026-126561", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126561", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126561.json", + "dateUpdated": "2026-11-11T02:35:57.916Z" + }, + { + "cveId": "CVE-2026-126562", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126562", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126562.json", + "dateUpdated": "2026-11-11T02:35:58.607Z" + }, + { + "cveId": "CVE-2026-126563", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126563", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126563.json", + "dateUpdated": "2026-11-11T02:35:59.252Z" + }, + { + "cveId": "CVE-2026-126564", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126564", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126564.json", + "dateUpdated": "2026-11-11T02:35:59.923Z" + }, + { + "cveId": "CVE-2026-126565", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126565", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126565.json", + "dateUpdated": "2026-11-11T02:36:00.573Z" + }, + { + "cveId": "CVE-2026-126566", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126566", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126566.json", + "dateUpdated": "2026-11-11T02:36:04.046Z" + }, + { + "cveId": "CVE-2026-126567", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126567", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126567.json", + "dateUpdated": "2026-11-11T02:36:04.769Z" + }, + { + "cveId": "CVE-2026-126569", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126569", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126569.json", + "dateUpdated": "2026-11-11T02:36:05.461Z" + }, + { + "cveId": "CVE-2026-126570", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126570", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126570.json", + "dateUpdated": "2026-11-11T02:36:06.228Z" + }, + { + "cveId": "CVE-2026-126571", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126571", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126571.json", + "dateUpdated": "2026-11-11T02:36:06.963Z" + }, + { + "cveId": "CVE-2026-63192", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-63192", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63192.json", + "dateUpdated": "2026-11-11T02:34:16.495Z" + }, + { + "cveId": "CVE-2026-63194", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-63194", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63194.json", + "dateUpdated": "2026-11-11T02:34:24.288Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-120244", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120244", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120244.json", + "dateUpdated": "2026-11-11T02:37:13.267Z" + }, + { + "cveId": "CVE-2026-120245", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120245", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120245.json", + "dateUpdated": "2026-11-11T02:37:14.008Z" + }, + { + "cveId": "CVE-2026-121454", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121454", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121454.json", + "dateUpdated": "2026-11-11T02:37:14.675Z" + } + ], + "error": [] + }, { "fetchTime": "2026-11-11T01:52:58.165Z", "numberOfChanges": 1, @@ -831261,168 +831635,5 @@ } ], "error": [] - }, - { - "fetchTime": "2026-10-12T03:10:17.568Z", - "numberOfChanges": 3, - "new": [ - { - "cveId": "CVE-2026-107437", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107437", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107437.json", - "dateUpdated": "2026-10-12T02:52:48.167Z" - }, - { - "cveId": "CVE-2026-108794", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108794", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108794.json", - "dateUpdated": "2026-10-12T03:00:08.022Z" - }, - { - "cveId": "CVE-2026-108985", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108985", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108985.json", - "dateUpdated": "2026-10-12T03:00:30.330Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T02:47:27.321Z", - "numberOfChanges": 13, - "new": [ - { - "cveId": "CVE-2026-108789", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108789", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108789.json", - "dateUpdated": "2026-10-12T02:15:31.636Z" - }, - { - "cveId": "CVE-2026-108790", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108790", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108790.json", - "dateUpdated": "2026-10-12T02:30:17.113Z" - }, - { - "cveId": "CVE-2026-108791", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108791", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108791.json", - "dateUpdated": "2026-10-12T02:45:14.525Z" - }, - { - "cveId": "CVE-2026-108981", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108981", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108981.json", - "dateUpdated": "2026-10-12T02:27:15.378Z" - }, - { - "cveId": "CVE-2026-108982", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108982", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108982.json", - "dateUpdated": "2026-10-12T02:44:04.730Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-17615", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17615", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17615.json", - "dateUpdated": "2026-10-12T02:06:14.501Z" - }, - { - "cveId": "CVE-2026-42169", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42169", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42169.json", - "dateUpdated": "2026-10-12T02:14:29.994Z" - }, - { - "cveId": "CVE-2026-58379", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58379", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58379.json", - "dateUpdated": "2026-10-12T02:08:04.619Z" - }, - { - "cveId": "CVE-2026-58380", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58380", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58380.json", - "dateUpdated": "2026-10-12T02:14:30.881Z" - }, - { - "cveId": "CVE-2026-58384", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58384", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58384.json", - "dateUpdated": "2026-10-12T02:08:06.811Z" - }, - { - "cveId": "CVE-2026-59090", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-59090", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59090.json", - "dateUpdated": "2026-10-12T02:08:10.029Z" - }, - { - "cveId": "CVE-2026-66758", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-66758", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66758.json", - "dateUpdated": "2026-10-12T02:08:13.155Z" - }, - { - "cveId": "CVE-2026-86320", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86320", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86320.json", - "dateUpdated": "2026-10-12T02:12:11.129Z" - } - ], - "error": [] - }, - { - "fetchTime": "2026-10-12T02:02:51.346Z", - "numberOfChanges": 7, - "new": [ - { - "cveId": "CVE-2026-108786", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108786", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108786.json", - "dateUpdated": "2026-10-12T01:30:23.368Z" - }, - { - "cveId": "CVE-2026-108787", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108787", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108787.json", - "dateUpdated": "2026-10-12T01:45:15.302Z" - }, - { - "cveId": "CVE-2026-108788", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108788", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108788.json", - "dateUpdated": "2026-10-12T02:00:56.424Z" - }, - { - "cveId": "CVE-2026-108980", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108980", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108980.json", - "dateUpdated": "2026-10-12T01:55:59.223Z" - }, - { - "cveId": "CVE-2026-66085", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-66085", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66085.json", - "dateUpdated": "2026-10-12T01:28:27.895Z" - }, - { - "cveId": "CVE-2026-66086", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-66086", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66086.json", - "dateUpdated": "2026-10-12T01:28:35.334Z" - }, - { - "cveId": "CVE-2026-87765", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-87765", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87765.json", - "dateUpdated": "2026-10-12T01:28:25.514Z" - } - ], - "updated": [], - "error": [] } ] \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index 1364c5d38b..2305ee87c0 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,7 +1,7 @@ { "source": "https://github.com/CVEProject/cvelistV5.git", - "upstream_commit": "6bd009f37f7321941dc701c2c51ef6bbed2204f0", + "upstream_commit": "ab59152b3a36e1cd4d740b8ecab41708e3724edc", "since_year": 2017, - "records": 330738, - "synced_at_utc": "2026-11-11T02:31:06.401758+00:00" + "records": 330766, + "synced_at_utc": "2026-11-11T03:30:01.397772+00:00" }