VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-13T15:29:51Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-13 16:29:56 +01:00
1 parent 294e0b4ec3
commit ee401d30f9
214 files changed
+17326 -1924
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2025/41xxx/CVE-2025-41725.json
+22 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "CERTVDE",
"dateReserved": "2025-04-16T11:17:48.318Z",
"datePublished": "2026-11-13T12:59:24.549Z",
"dateUpdated": "2026-11-13T12:59:24.549Z"
"dateUpdated": "2026-11-13T15:03:50.513Z"
},
"containers": {
"cna": {
@@ -16,7 +16,7 @@
{
"defaultStatus": "unaffected",
"product": "Flip 4",
"vendor": "Harman International",
"vendor": "JBL",
"versions": [
{
"lessThan": "4.1.0",
@@ -27,6 +27,25 @@
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jbl:flip_4:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0",
"versionStartIncluding": "0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
@@ -87,7 +106,7 @@
"providerMetadata": {
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE",
"dateUpdated": "2026-11-13T12:59:24.549Z"
"dateUpdated": "2026-11-13T15:03:50.513Z"
},
"references": [
{
data/2026/0xxx/CVE-2026-0191.json
+34 -6
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2025-10-23T08:45:43.329Z",
"datePublished": "2026-11-10T19:20:12.706Z",
"dateUpdated": "2026-11-13T05:00:34.276Z"
"dateUpdated": "2026-11-13T14:42:28.969Z"
},
"containers": {
"cna": {
@@ -57,13 +57,41 @@
},
"adp": [
{
"title": "CISA ADP Vulnrichment",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-693",
"lang": "en",
"description": "CWE-693 Protection Mechanism Failure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T00:00:00+00:00",
"timestamp": "2026-11-13T05:00:35.257827Z",
"id": "CVE-2026-0191",
"options": [
{
"Exploitation": "none"
@@ -76,16 +104,16 @@
}
],
"role": "CISA Coordinator",
"version": "2.0.3",
"id": "CVE-2026-0191"
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T05:00:34.276Z"
"dateUpdated": "2026-11-13T14:42:28.969Z"
}
}
]
data/2026/100xxx/CVE-2026-100080.json
+22 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Linux",
"dateReserved": "2026-09-25T10:25:14.456Z",
"datePublished": "2026-11-06T18:23:01.824Z",
"dateUpdated": "2026-11-06T19:08:40.599Z"
"dateUpdated": "2026-11-13T14:17:19.465Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-11-06T18:23:01.824Z"
"dateUpdated": "2026-11-13T14:17:19.465Z"
},
"descriptions": [
{
@@ -75,6 +75,12 @@
"status": "affected",
"versionType": "git"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "5fb756f1bbec7a3862dda5d79028bf656271804c",
"status": "affected",
"versionType": "git"
},
{
"version": "0",
"lessThan": "5.10.274",
@@ -169,6 +175,12 @@
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.4-rc2",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
@@ -214,6 +226,11 @@
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4-rc2"
}
]
}
@@ -241,6 +258,9 @@
},
{
"url": "https://git.kernel.org/stable/c/4867687b6ad28ab84bc0811d8f8f9972e769da02"
},
{
"url": "https://git.kernel.org/stable/c/5fb756f1bbec7a3862dda5d79028bf656271804c"
}
],
"title": "xen-netback: Fix UAF when reading statistics data",
data/2026/100xxx/CVE-2026-100081.json
+23 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Linux",
"dateReserved": "2026-09-25T10:25:14.456Z",
"datePublished": "2026-11-06T18:23:02.185Z",
"dateUpdated": "2026-11-10T16:57:39.730Z"
"dateUpdated": "2026-11-13T14:17:19.978Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-11-10T16:57:39.730Z"
"dateUpdated": "2026-11-13T14:17:19.978Z"
},
"descriptions": [
{
@@ -91,6 +91,12 @@
"lessThan": "fb38fc58acb26d74fe8f7b19621fafaae3c040ff",
"status": "affected",
"versionType": "git"
},
{
"version": "b17075d5c1988b83f840d272c795ac17d57ce804",
"lessThan": "bfddc420afe827d9f06458cdf8087cd602f8c9cb",
"status": "affected",
"versionType": "git"
}
]
},
@@ -155,6 +161,12 @@
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.4-rc2",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
@@ -207,6 +219,12 @@
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "7.3.3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "7.4-rc2"
}
]
}
@@ -234,6 +252,9 @@
},
{
"url": "https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff"
},
{
"url": "https://git.kernel.org/stable/c/bfddc420afe827d9f06458cdf8087cd602f8c9cb"
}
],
"title": "xen-netback: defer xenvif_mcast_addr_list_free()",
data/2026/100xxx/CVE-2026-100082.json
+44 -48
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Linux",
"dateReserved": "2026-09-25T10:25:14.456Z",
"datePublished": "2026-11-06T18:23:02.627Z",
"dateUpdated": "2026-11-06T19:08:45.432Z"
"dateUpdated": "2026-11-13T14:17:20.531Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-11-06T18:23:02.627Z"
"dateUpdated": "2026-11-13T14:17:20.531Z"
},
"descriptions": [
{
@@ -35,88 +35,52 @@
],
"versions": [
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"version": "db6fbc106786f26d95889c50c18b1f28aa543a17",
"lessThan": "253cff0526781e28b1b0f9fdacd74ecdc23d3ab7",
"status": "affected",
"versionType": "git"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"version": "db6fbc106786f26d95889c50c18b1f28aa543a17",
"lessThan": "2c9ccbe0ffcff3615c7ad917c49b67571a41f21c",
"status": "affected",
"versionType": "git"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"version": "db6fbc106786f26d95889c50c18b1f28aa543a17",
"lessThan": "58ba056991dbcec8a75e6861cb4479ac947b69e6",
"status": "affected",
"versionType": "git"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"version": "db6fbc106786f26d95889c50c18b1f28aa543a17",
"lessThan": "fe9ead8c5bdb752e329cecfecbdb5dfca5e9996b",
"status": "affected",
"versionType": "git"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"version": "db6fbc106786f26d95889c50c18b1f28aa543a17",
"lessThan": "b764e17313534794aeb99c901869f213e36a16ef",
"status": "affected",
"versionType": "git"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"version": "db6fbc106786f26d95889c50c18b1f28aa543a17",
"lessThan": "c49934da934cf495faf782aa5d84f413221c9be6",
"status": "affected",
"versionType": "git"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"version": "db6fbc106786f26d95889c50c18b1f28aa543a17",
"lessThan": "b0378161c28e77e4d0e2eda3c9433ab4394d2a2f",
"status": "affected",
"versionType": "git"
},
{
"version": "0",
"lessThan": "5.10.274",
"version": "db6fbc106786f26d95889c50c18b1f28aa543a17",
"lessThan": "a02926f7c89bfc798ee9514e09694ff4279928a1",
"status": "affected",
"versionType": "semver"
},
{
"version": "0",
"lessThan": "5.15.225",
"status": "affected",
"versionType": "semver"
},
{
"version": "0",
"lessThan": "6.1.192",
"status": "affected",
"versionType": "semver"
},
{
"version": "0",
"lessThan": "6.6.162",
"status": "affected",
"versionType": "semver"
},
{
"version": "0",
"lessThan": "6.12.116",
"status": "affected",
"versionType": "semver"
},
{
"version": "0",
"lessThan": "6.18.62",
"status": "affected",
"versionType": "semver"
},
{
"version": "0",
"lessThan": "7.3.3",
"status": "affected",
"versionType": "semver"
"versionType": "git"
}
]
},
@@ -130,6 +94,16 @@
"drivers/block/xen-blkback/xenbus.c"
],
"versions": [
{
"version": "4.5",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.5",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.274",
"lessThanOrEqual": "5.10.*",
@@ -171,6 +145,12 @@
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.4-rc2",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
@@ -185,37 +165,50 @@
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5",
"versionEndExcluding": "5.10.274"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5",
"versionEndExcluding": "5.15.225"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5",
"versionEndExcluding": "6.1.192"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5",
"versionEndExcluding": "6.6.162"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5",
"versionEndExcluding": "6.12.116"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5",
"versionEndExcluding": "6.18.62"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5",
"versionEndExcluding": "7.3.3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.5",
"versionEndExcluding": "7.4-rc2"
}
]
}
@@ -243,6 +236,9 @@
},
{
"url": "https://git.kernel.org/stable/c/b0378161c28e77e4d0e2eda3c9433ab4394d2a2f"
},
{
"url": "https://git.kernel.org/stable/c/a02926f7c89bfc798ee9514e09694ff4279928a1"
}
],
"title": "xen-blkback: Avoid UAF when reading I/O statistics",
data/2026/103xxx/CVE-2026-103769.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-103769",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-01T10:49:33.286Z",
"datePublished": "2026-11-13T15:08:38.923Z",
"dateUpdated": "2026-11-13T15:08:38.923Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:38.923Z"
},
"title": "WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.4.10 - PHP Object Injection vulnerability",
"datePublic": "2026-11-11T14:03:23.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.<p>This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.</p>"
}
]
}
],
"affected": [
{
"vendor": "Acowebs",
"product": "PDF Invoices and Packing Slips For WooCommerce",
"packageName": "pdf-invoices-and-packing-slips-for-woocommerce",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.4.10",
"changes": [
{
"at": "1.4.11",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/pdf-invoices-and-packing-slips-for-woocommerce/vulnerability/wordpress-pdf-invoices-and-packing-slips-for-woocommerce-plugin-1-4-10-php-object-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Ananda Dhakal (Patchstack)",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "Object Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress PDF Invoices and Packing Slips For WooCommerce plugin to the latest available version (at least 1.4.11).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress PDF Invoices and Packing Slips For WooCommerce plugin to the latest available version (at least 1.4.11)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/105xxx/CVE-2026-105427.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-05T12:48:41.073Z",
"datePublished": "2026-11-10T15:57:39.124Z",
"dateUpdated": "2026-11-10T17:29:09.471Z"
"dateUpdated": "2026-11-13T14:30:29.382Z"
},
"containers": {
"cna": {
@@ -113,6 +113,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:43.876602Z",
"id": "CVE-2026-105427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:30:29.382Z"
}
}
]
}
}
data/2026/105xxx/CVE-2026-105669.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-05T16:57:22.487Z",
"datePublished": "2026-11-10T15:45:42.277Z",
"dateUpdated": "2026-11-10T17:32:18.042Z"
"dateUpdated": "2026-11-13T14:30:43.063Z"
},
"containers": {
"cna": {
@@ -113,6 +113,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:39.429831Z",
"id": "CVE-2026-105669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:30:43.063Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107404.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-07T21:35:39.743Z",
"datePublished": "2026-11-10T15:59:51.214Z",
"dateUpdated": "2026-11-10T17:29:46.336Z"
"dateUpdated": "2026-11-13T14:30:22.809Z"
},
"containers": {
"cna": {
@@ -113,6 +113,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:46.340118Z",
"id": "CVE-2026-107404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:30:22.809Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107522.json
+284
View File
@@ -0,0 +1,284 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107522",
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"state": "PUBLISHED",
"assignerShortName": "dell",
"dateReserved": "2026-10-08T10:04:10.615Z",
"datePublished": "2026-11-13T14:59:55.571Z",
"dateUpdated": "2026-11-13T14:59:55.571Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell",
"dateUpdated": "2026-11-13T14:59:55.571Z"
},
"datePublic": "2026-10-30T06:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Dell",
"product": "PowerStore 500T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 7000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator."
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/107xxx/CVE-2026-107523.json
+284
View File
@@ -0,0 +1,284 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107523",
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"state": "PUBLISHED",
"assignerShortName": "dell",
"dateReserved": "2026-10-08T10:04:10.615Z",
"datePublished": "2026-11-13T14:48:13.772Z",
"dateUpdated": "2026-11-13T14:48:13.772Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell",
"dateUpdated": "2026-11-13T14:48:13.772Z"
},
"datePublic": "2026-10-30T06:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Dell",
"product": "PowerStore 500T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 7000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service."
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.7,
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/107xxx/CVE-2026-107524.json
+284
View File
@@ -0,0 +1,284 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107524",
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"state": "PUBLISHED",
"assignerShortName": "dell",
"dateReserved": "2026-10-08T10:04:10.615Z",
"datePublished": "2026-11-13T14:30:19.045Z",
"dateUpdated": "2026-11-13T14:30:19.045Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell",
"dateUpdated": "2026-11-13T14:30:19.045Z"
},
"datePublic": "2026-10-30T06:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Dell",
"product": "PowerStore 500T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 7000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service."
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/109xxx/CVE-2026-109092.json
+169
View File
@@ -0,0 +1,169 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-109092",
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"state": "PUBLISHED",
"assignerShortName": "suse",
"dateReserved": "2026-10-12T06:41:23.778Z",
"datePublished": "2026-11-13T15:00:03.444Z",
"dateUpdated": "2026-11-13T15:00:03.444Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse",
"dateUpdated": "2026-11-13T15:00:03.444Z"
},
"title": "X.Org Server XvShmPutImage Shared-Memory Bounds Overflow",
"datePublic": "2026-11-13T14:25:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-191",
"description": "CWE-191 Integer underflow (wrap or wraparound)",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"affected": [
{
"vendor": "X.Org",
"product": "xwayland",
"packageName": "xwayland",
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.1.15",
"versionType": "rpm"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "X.Org",
"product": "xorg-x11-server",
"packageName": "xorg-x11-server",
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "21.1.26",
"versionType": "rpm"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "24.1.15"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "21.1.26"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Incorrectly handled negative sizes when processing&nbsp;<span>ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code.</span>"
}
]
}
],
"references": [
{
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/a4d7800f0f56469a082e3755bfa6b148c707075c",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"credits": [
{
"lang": "en",
"value": "Acts1631 <acts1631kjv@proton.me>",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/109xxx/CVE-2026-109093.json
+179
View File
@@ -0,0 +1,179 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-109093",
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"state": "PUBLISHED",
"assignerShortName": "suse",
"dateReserved": "2026-10-12T06:41:23.778Z",
"datePublished": "2026-11-13T14:23:59.219Z",
"dateUpdated": "2026-11-13T14:23:59.219Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse",
"dateUpdated": "2026-11-13T14:23:59.219Z"
},
"title": "X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write",
"datePublic": "2026-11-13T14:20:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"affected": [
{
"vendor": "X.Org",
"product": "xwayland",
"packageName": "xwayland",
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.1.15",
"versionType": "rpm"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "X.Org",
"product": "xorg-x11-server",
"packageName": "xorg-x11-server",
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "21.1.26",
"versionType": "rpm"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "24.1.15"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "21.1.26"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack buffer overflow in  ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A stack buffer overflow in&nbsp;&nbsp;<span>ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server.</span>"
}
]
}
],
"references": [
{
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/99ce069ae814b39048543062e073320f14723ee0",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.5,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "Acts1631 <acts1631kjv@proton.me>",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/109xxx/CVE-2026-109094.json
+172
View File
@@ -0,0 +1,172 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-109094",
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"state": "PUBLISHED",
"assignerShortName": "suse",
"dateReserved": "2026-10-12T06:41:23.778Z",
"datePublished": "2026-11-13T14:14:53.929Z",
"dateUpdated": "2026-11-13T14:25:11.368Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse",
"dateUpdated": "2026-11-13T14:25:11.368Z"
},
"title": "X.Org Server XRes QueryResourceBytes Swap Path Size Overflow",
"datePublic": "2026-11-13T13:53:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-190",
"description": "CWE-190 Integer overflow or wraparound",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"affected": [
{
"vendor": "X.Org",
"product": "xwayland",
"packageName": "xwayland",
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.1.15",
"versionType": "rpm"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "X.Org",
"product": "xorg-x11-server",
"packageName": "xorg-x11-server",
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "21.1.26",
"versionType": "rpm"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "24.1.15"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "21.1.26"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A integer overflow that can lead to a buffer overrread in the&nbsp;<span>XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server.</span>"
}
]
}
],
"references": [
{
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/a59678e491a762e504829cac069cf37f4ccafe0d",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.5,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/109xxx/CVE-2026-109097.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "siemens",
"dateReserved": "2026-10-12T06:50:03.941Z",
"datePublished": "2026-11-10T11:30:39.049Z",
"dateUpdated": "2026-11-10T11:30:39.049Z"
"dateUpdated": "2026-11-13T15:11:52.928Z"
},
"containers": {
"cna": {
@@ -73,6 +73,40 @@
"url": "https://cert-portal.siemens.com/productcert/html/ssa-435267.html"
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:09:59.876452Z",
"id": "CVE-2026-109097",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:11:52.928Z"
}
}
]
}
}
data/2026/109xxx/CVE-2026-109445.json
+142
View File
@@ -0,0 +1,142 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-109445",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-10-12T15:52:36.683Z",
"datePublished": "2026-11-13T14:48:23.301Z",
"dateUpdated": "2026-11-13T14:48:23.301Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T14:48:23.301Z"
},
"title": "PLANET GS-5220-8P2T2S Stack Buffer Overflow via webstax_auth Cookie",
"descriptions": [
{
"lang": "en",
"value": "PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstax_auth HTTP Cookie value that is copied into a fixed-size stack buffer without length validation. Attackers can send a crafted unauthenticated HTTP request with an oversized cookie to overwrite the saved return address and corrupt stack memory, leading to memory corruption and potential denial of service on the device."
}
],
"datePublic": "2026-11-13T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Stack-based Buffer Overflow",
"cweId": "CWE-121",
"type": "CWE"
}
]
}
],
"affected": [
{
"defaultStatus": "unaffected",
"vendor": "PLANET Technology Corp.",
"product": "PLANET GS-5220-8P2T2S",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThan": "3.2412b261008"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "CRITICAL",
"baseScore": 9.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"version": "3.1",
"baseSeverity": "CRITICAL",
"baseScore": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"references": [
{
"url": "https://www.planet.com.tw/en/support/security-advisory/12",
"name": "Vendor Advisory",
"tags": [
"vendor-advisory",
"patch"
]
},
{
"url": "https://www.vulncheck.com/advisories/planet-gs-5220-8p2t2s-stack-buffer-overflow-via-webstax-auth-cookie",
"name": "VulnCheck Advisory: PLANET GS-5220-8P2T2S Stack Buffer Overflow via webstax_auth Cookie",
"tags": [
"third-party-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "Tianchang Yang and Syed Rafiul Hussain (SyNSec Lab, Penn State University)",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck"
}
}
}
}
data/2026/109xxx/CVE-2026-109904.json
+8 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "suse",
"dateReserved": "2026-10-13T09:50:30.690Z",
"datePublished": "2026-11-13T10:27:48.418Z",
"dateUpdated": "2026-11-13T10:27:48.418Z"
"dateUpdated": "2026-11-13T15:13:55.307Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse",
"dateUpdated": "2026-11-13T10:27:48.418Z"
"dateUpdated": "2026-11-13T15:13:55.307Z"
},
"title": "X.Org Server XRes QueryClientIds Request Size Overflow",
"datePublic": "2026-11-13T10:18:00.000Z",
@@ -124,6 +124,12 @@
"tags": [
"patch"
]
},
{
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/a3899d75e180d73f2971af2a402e6fdf19c0339c",
"tags": [
"patch"
]
}
],
"metrics": [
data/2026/111xxx/CVE-2026-111545.json
+284
View File
@@ -0,0 +1,284 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-111545",
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"state": "PUBLISHED",
"assignerShortName": "dell",
"dateReserved": "2026-10-16T10:04:03.180Z",
"datePublished": "2026-11-13T15:15:45.253Z",
"dateUpdated": "2026-11-13T15:15:45.253Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell",
"dateUpdated": "2026-11-13T15:15:45.253Z"
},
"datePublic": "2026-10-30T06:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Dell",
"product": "PowerStore 500T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 7000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted certificates.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted certificates."
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/111xxx/CVE-2026-111547.json
+284
View File
@@ -0,0 +1,284 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-111547",
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"state": "PUBLISHED",
"assignerShortName": "dell",
"dateReserved": "2026-10-16T10:04:03.181Z",
"datePublished": "2026-11-13T14:40:14.978Z",
"dateUpdated": "2026-11-13T14:40:14.978Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell",
"dateUpdated": "2026-11-13T14:40:14.978Z"
},
"datePublic": "2026-10-30T06:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Dell",
"product": "PowerStore 500T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 7000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure."
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/112xxx/CVE-2026-112306.json
+5 -5
View File
@@ -8,21 +8,21 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-10-19T14:14:28.386Z",
"datePublished": "2026-10-19T15:28:56.450Z",
"dateUpdated": "2026-10-19T16:33:44.883Z"
"dateUpdated": "2026-11-13T15:12:37.261Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-10-19T15:28:56.450Z"
"dateUpdated": "2026-11-13T15:12:37.261Z"
},
"datePublic": "2026-10-09T14:44:39.000Z",
"title": "NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields",
"title": "NocoBase plugin-collection-sql through 2.2.46 SQL Injection via sqlCollection:setFields",
"descriptions": [
{
"lang": "en",
"value": "NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file."
"value": "NocoBase @nocobase/plugin-collection-sql through 2.2.46 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file."
}
],
"problemTypes": [
@@ -45,7 +45,7 @@
"versions": [
{
"version": "0",
"lessThanOrEqual": "2.2.28",
"lessThanOrEqual": "2.2.46",
"status": "affected",
"versionType": "semver"
}
data/2026/114xxx/CVE-2026-114406.json
+54 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-21T11:57:07.758Z",
"datePublished": "2026-10-21T20:56:26.866Z",
"dateUpdated": "2026-11-13T12:22:07.495Z"
"dateUpdated": "2026-11-13T14:55:05.860Z"
},
"containers": {
"cna": {
@@ -1060,6 +1060,42 @@
"cpe:/a:redhat:cost_management_on_premise:1::el10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 1.10",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhdh/rhdh-hub-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1794341043",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhdh:1.10::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 2.1",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhdh/rhdh-hub-rhel10",
"defaultStatus": "affected",
"versions": [
{
"version": "1794002463",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhdh:2.1::el10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Discovery 2",
@@ -4968,16 +5004,6 @@
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhdh/rhdh-hub-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:rhdh:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 2",
@@ -6190,6 +6216,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:96391",
"name": "RHSA-2026:96391",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:96400",
"name": "RHSA-2026:96400",
@@ -6214,6 +6248,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99044",
"name": "RHSA-2026:99044",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99787",
"name": "RHSA-2026:99787",
@@ -6313,7 +6355,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-13T12:22:07.495Z"
"dateUpdated": "2026-11-13T14:55:05.860Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/118xxx/CVE-2026-118383.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-10-28T02:46:37.683Z",
"datePublished": "2026-11-10T20:23:51.424Z",
"dateUpdated": "2026-11-10T20:23:51.424Z"
"dateUpdated": "2026-11-13T14:20:14.490Z"
},
"containers": {
"cna": {
@@ -166,6 +166,40 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:14:20.952752Z",
"id": "CVE-2026-118383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:20:14.490Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118976.json
+112
View File
@@ -0,0 +1,112 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118976",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-10-29T09:13:28.520Z",
"datePublished": "2026-11-13T14:33:21.126Z",
"dateUpdated": "2026-11-13T14:33:21.126Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-13T14:33:21.126Z"
},
"title": "Path Traversal in Telerik UI for Blazor Demo's Chat AI Integration Example",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-23",
"description": "CWE-23 Relative path traversal",
"type": "CWE"
}
]
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Telerik UI for Blazor",
"versions": [
{
"status": "affected",
"version": "11.1.0",
"lessThan": "14.1.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope."
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/blazor-ui/documentation/knowledge-base/kb-security-demo-path-traversal-cve-2026-118976",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "HIGH",
"baseScore": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/119xxx/CVE-2026-119102.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-119102",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-10-29T14:03:06.311Z",
"datePublished": "2026-11-13T14:36:49.832Z",
"dateUpdated": "2026-11-13T14:53:46.142Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-13T14:53:46.142Z"
},
"title": "AI Command Filters On Any Property Bypassing Column Allowlist",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Telerik UI for Blazor",
"versions": [
{
"status": "affected",
"version": "12.0.0",
"lessThan": "16.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist."
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/blazor-ui/documentation/knowledge-base/kb-security-improper-input-validation-cve-2026-119102",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/119xxx/CVE-2026-119512.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-119512",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-30T09:20:18.657Z",
"datePublished": "2026-11-13T15:08:41.154Z",
"dateUpdated": "2026-11-13T15:08:41.154Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:41.154Z"
},
"title": "WordPress Newsletters plugin <= 4.18.2 - PHP Object Injection vulnerability",
"datePublic": "2026-11-11T14:12:24.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.<p>This issue affects Newsletters: from n/a through 4.18.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "Tribulant Software",
"product": "Newsletters",
"packageName": "newsletters-lite",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.18.2",
"changes": [
{
"at": "4.18.3",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-2-php-object-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Quang Tan | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "Object Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Newsletters plugin to the latest available version (at least 4.18.3).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Newsletters plugin to the latest available version (at least 4.18.3)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/119xxx/CVE-2026-119517.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-119517",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-30T09:20:18.657Z",
"datePublished": "2026-11-13T15:08:43.236Z",
"dateUpdated": "2026-11-13T15:08:43.236Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:43.236Z"
},
"title": "WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:17:35.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.<p>This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3.</p>"
}
]
}
],
"affected": [
{
"vendor": "VillaTheme",
"product": "Catna – Woo Name Your Price and Offers",
"packageName": "catna-woo-name-your-price-and-offers",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.0.3",
"changes": [
{
"at": "2.0.4",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/catna-woo-name-your-price-and-offers/vulnerability/wordpress-catna-woo-name-your-price-and-offers-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Peter Tang | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Catna – Woo Name Your Price and Offers plugin to the latest available version (at least 2.0.4).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Catna – Woo Name Your Price and Offers plugin to the latest available version (at least 2.0.4)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/119xxx/CVE-2026-119618.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-30T12:32:13.904Z",
"datePublished": "2026-11-11T14:54:08.155Z",
"dateUpdated": "2026-11-12T20:56:56.991Z"
"dateUpdated": "2026-11-13T14:17:19.945Z"
},
"containers": {
"cna": {
@@ -147,6 +147,54 @@
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:17:15.903768Z",
"id": "CVE-2026-119618",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:17:19.945Z"
}
}
]
}
data/2026/120xxx/CVE-2026-120326.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Vaadin",
"dateReserved": "2026-11-01T13:24:59.528Z",
"datePublished": "2026-11-10T11:49:52.046Z",
"dateUpdated": "2026-11-10T11:49:52.046Z"
"dateUpdated": "2026-11-13T14:31:13.918Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:29.596217Z",
"id": "CVE-2026-120326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:31:13.918Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120350.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Vaadin",
"dateReserved": "2026-11-01T19:47:45.740Z",
"datePublished": "2026-11-10T11:50:08.635Z",
"dateUpdated": "2026-11-10T11:50:08.635Z"
"dateUpdated": "2026-11-13T14:31:06.419Z"
},
"containers": {
"cna": {
@@ -262,6 +262,40 @@
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:32.180656Z",
"id": "CVE-2026-120350",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:31:06.419Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120835.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120835",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-03T00:24:21.836Z",
"datePublished": "2026-11-13T15:08:40.812Z",
"dateUpdated": "2026-11-13T15:08:40.812Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:40.812Z"
},
"title": "WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.11 - PHP Object Injection vulnerability",
"datePublic": "2026-11-11T14:11:52.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.<p>This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11.</p>"
}
]
}
],
"affected": [
{
"vendor": "VillaTheme",
"product": "AFFI – Affiliate Marketing for WooCommerce",
"packageName": "affi-affiliate-marketing-for-woo",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.0.11",
"changes": [
{
"at": "1.0.12",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Siyang Wu | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "Object Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress AFFI – Affiliate Marketing for WooCommerce plugin to the latest available version (at least 1.0.12).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress AFFI – Affiliate Marketing for WooCommerce plugin to the latest available version (at least 1.0.12)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/121xxx/CVE-2026-121191.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "TR-CERT",
"dateReserved": "2026-11-03T10:21:47.171Z",
"datePublished": "2026-11-10T11:52:12.493Z",
"dateUpdated": "2026-11-10T11:52:12.493Z"
"dateUpdated": "2026-11-13T14:30:58.317Z"
},
"containers": {
"cna": {
@@ -120,6 +120,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:34.809192Z",
"id": "CVE-2026-121191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:30:58.317Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121776.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-121776",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-04T00:24:30.154Z",
"datePublished": "2026-11-13T15:08:41.752Z",
"dateUpdated": "2026-11-13T15:08:41.752Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:41.752Z"
},
"title": "WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T14:13:09.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Passster: from n/a through 4.3.20.</p>"
}
]
}
],
"affected": [
{
"vendor": "WP Chill",
"product": "Passster",
"packageName": "content-protector",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.3.20",
"changes": [
{
"at": "4.3.21",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/content-protector/vulnerability/wordpress-passster-plugin-4-3-20-broken-access-control-vulnerability-2?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Malvin Valerian Gultom | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Passster plugin to the latest available version (at least 4.3.21).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Passster plugin to the latest available version (at least 4.3.21)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/123xxx/CVE-2026-123082.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Docker",
"dateReserved": "2026-11-05T10:56:32.202Z",
"datePublished": "2026-11-10T14:37:24.600Z",
"dateUpdated": "2026-11-10T14:37:24.600Z"
"dateUpdated": "2026-11-13T14:30:51.277Z"
},
"containers": {
"cna": {
@@ -110,6 +110,40 @@
"source": {
"discovery": "INTERNAL"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:37.065673Z",
"id": "CVE-2026-123082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:30:51.277Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123181.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-11-05T16:55:42.443Z",
"datePublished": "2026-11-10T15:52:01.338Z",
"dateUpdated": "2026-11-10T17:33:46.264Z"
"dateUpdated": "2026-11-13T14:30:35.722Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:41.675760Z",
"id": "CVE-2026-123181",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:30:35.722Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123710.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-06T10:23:55.509Z",
"datePublished": "2026-11-11T15:02:31.341Z",
"dateUpdated": "2026-11-13T00:21:58.960Z"
"dateUpdated": "2026-11-13T14:18:08.901Z"
},
"containers": {
"cna": {
@@ -390,6 +390,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:17:57.069419Z",
"id": "CVE-2026-123710",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:18:08.901Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123975.json
+157
View File
@@ -0,0 +1,157 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123975",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T17:54:13.735Z",
"datePublished": "2026-11-13T15:01:44.332Z",
"dateUpdated": "2026-11-13T15:01:44.332Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T15:01:44.332Z"
},
"datePublic": "2026-11-11T00:00:00.000Z",
"title": "Grid Community Toolkit globus-gss-assist before 12.9 Pre-Authentication Heap Out-of-Bounds Write",
"descriptions": [
{
"lang": "en",
"value": "Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus_gss_assist_token_get_fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Out-of-bounds Write",
"cweId": "CWE-787",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Grid Community Forum",
"product": "Grid Community Toolkit",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "6.2.20261111"
}
],
"packageURL": "pkg:github/gridcf/gct",
"repo": "https://github.com/gridcf/gct"
},
{
"vendor": "Grid Community Forum",
"product": "globus-gss-assist",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "12.9"
}
],
"packageURL": "pkg:github/gridcf/gct",
"repo": "https://github.com/gridcf/gct"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://gridcf.org/#2026-11-11",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://github.com/gridcf/gct/commit/3df2be4834c146bdcec90009a0f2e5771ff63cca",
"tags": [
"patch"
]
},
{
"url": "https://github.com/gridcf/gct/releases/tag/v6.2.20261111",
"tags": [
"release-notes"
],
"name": "Grid Community Toolkit v6.2.20261111 Release Notes"
},
{
"url": "https://github.com/gridcf/gct/blob/v6.2.20190829/gsi/gss_assist/source/tokens_f.c",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: Grid Community Toolkit globus-gss-assist before 12.9 Pre-Authentication Heap Out-of-Bounds Write",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grid-community-toolkit-globus-gss-assist-before-12.9-pre-authentication-heap-out-of-bounds-write"
}
],
"credits": [
{
"lang": "en",
"value": "Deus Rex",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/124xxx/CVE-2026-124002.json
+17 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:34:26.958Z",
"dateUpdated": "2026-11-12T19:55:42.192Z"
"dateUpdated": "2026-11-13T14:44:18.509Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T19:55:42.192Z"
"dateUpdated": "2026-11-13T14:44:18.509Z"
},
"title": "Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username",
"descriptions": [
@@ -133,12 +133,27 @@
"product"
]
},
{
"url": "https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf",
"name": "End of Support Announcement",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username",
"name": "VulnCheck Advisory: Dixell/Copeland XWEB EVO Pre-Authentication OS Command Injection via Username",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"exploit",
"technical-description"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124003.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:37:11.873Z",
"dateUpdated": "2026-11-13T00:24:39.423Z"
"dateUpdated": "2026-11-13T14:33:36.388Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T19:40:00.629Z"
"dateUpdated": "2026-11-13T14:33:36.388Z"
},
"title": "Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection",
"descriptions": [
@@ -140,6 +140,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124004.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:41:02.897Z",
"dateUpdated": "2026-11-12T20:08:34.593Z"
"dateUpdated": "2026-11-13T14:33:54.784Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:08:34.593Z"
"dateUpdated": "2026-11-13T14:33:54.784Z"
},
"title": "Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password",
"descriptions": [
@@ -140,6 +140,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124005.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:42:31.109Z",
"dateUpdated": "2026-11-12T20:08:44.853Z"
"dateUpdated": "2026-11-13T14:34:10.836Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:08:44.853Z"
"dateUpdated": "2026-11-13T14:34:10.836Z"
},
"title": "Dixell/Copeland XWEB EVO Predictable Administrator Password Generation",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124006.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:44:23.841Z",
"dateUpdated": "2026-11-12T20:08:58.024Z"
"dateUpdated": "2026-11-13T14:34:42.790Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:08:58.024Z"
"dateUpdated": "2026-11-13T14:34:42.790Z"
},
"title": "Dixell/Copeland XWEB EVO Predictable Root Password Generation",
"descriptions": [
@@ -141,6 +141,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124007.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:48:39.316Z",
"dateUpdated": "2026-11-13T00:26:01.605Z"
"dateUpdated": "2026-11-13T14:34:59.402Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:09:08.569Z"
"dateUpdated": "2026-11-13T14:34:59.402Z"
},
"title": "Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124008.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:53:16.327Z",
"dateUpdated": "2026-11-12T20:09:16.896Z"
"dateUpdated": "2026-11-13T14:35:18.051Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:09:16.896Z"
"dateUpdated": "2026-11-13T14:35:18.051Z"
},
"title": "Dixell/Copeland XWEB EVO OS Command Injection via devices.lua",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124009.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:54:31.046Z",
"dateUpdated": "2026-11-12T20:09:28.171Z"
"dateUpdated": "2026-11-13T14:35:35.464Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:09:28.171Z"
"dateUpdated": "2026-11-13T14:35:35.464Z"
},
"title": "Dixell/Copeland XWEB EVO OS Command Injection via backup.lua",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124010.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:58:13.919Z",
"dateUpdated": "2026-11-12T20:09:38.355Z"
"dateUpdated": "2026-11-13T14:35:53.821Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:09:38.355Z"
"dateUpdated": "2026-11-13T14:35:53.821Z"
},
"title": "Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi",
"descriptions": [
@@ -141,6 +141,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124011.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T19:59:37.292Z",
"dateUpdated": "2026-11-13T00:26:35.263Z"
"dateUpdated": "2026-11-13T14:36:10.099Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:09:47.317Z"
"dateUpdated": "2026-11-13T14:36:10.099Z"
},
"title": "Dixell/Copeland XWEB EVO Information Disclosure via sysinfo.lua",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124012.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T20:01:03.642Z",
"dateUpdated": "2026-11-12T20:09:56.715Z"
"dateUpdated": "2026-11-13T14:36:28.267Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:09:56.715Z"
"dateUpdated": "2026-11-13T14:36:28.267Z"
},
"title": "Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124013.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.543Z",
"datePublished": "2026-11-12T20:02:57.378Z",
"dateUpdated": "2026-11-12T20:10:06.208Z"
"dateUpdated": "2026-11-13T14:36:45.378Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:10:06.208Z"
"dateUpdated": "2026-11-13T14:36:45.378Z"
},
"title": "Dixell/Copeland XWEB EVO OS Command Injection via api.lua",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124014.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.544Z",
"datePublished": "2026-11-12T20:05:59.683Z",
"dateUpdated": "2026-11-12T20:10:16.485Z"
"dateUpdated": "2026-11-13T14:37:05.009Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:10:16.485Z"
"dateUpdated": "2026-11-13T14:37:05.009Z"
},
"title": "Dixell/Copeland XWEB EVO Unauthenticated Configuration Write via config.lua",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124015.json
+10 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.544Z",
"datePublished": "2026-11-12T20:07:32.288Z",
"dateUpdated": "2026-11-13T00:40:02.514Z"
"dateUpdated": "2026-11-13T14:37:28.477Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T20:10:25.011Z"
"dateUpdated": "2026-11-13T14:37:28.477Z"
},
"title": "Dixell/Copeland XWEB EVO Authentication Bypass via users.lua",
"descriptions": [
@@ -135,6 +135,14 @@
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root",
"name": "VulnCheck Blog",
"tags": [
"technical-description",
"exploit"
]
}
],
"credits": [
data/2026/124xxx/CVE-2026-124260.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124260",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:41.519Z",
"dateUpdated": "2026-11-13T15:08:41.519Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:41.519Z"
},
"title": "WordPress WP Photo Album Plus plugin <= 9.3.06.001 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:13:01.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.06.001.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.<p>This issue affects WP Photo Album Plus: from n/a through 9.3.06.001.</p>"
}
]
}
],
"affected": [
{
"vendor": "Jacob N. Breetvelt",
"product": "WP Photo Album Plus",
"packageName": "wp-photo-album-plus",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "9.3.06.001",
"changes": [
{
"at": "9.3.06.002",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-3-06-001-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "AndrewN | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress WP Photo Album Plus plugin to the latest available version (at least 9.3.06.002).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress WP Photo Album Plus plugin to the latest available version (at least 9.3.06.002)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124265.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124265",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:42.588Z",
"dateUpdated": "2026-11-13T15:08:42.588Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:42.588Z"
},
"title": "WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability",
"datePublic": "2026-11-11T14:16:37.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.<p>This issue affects Newsletters: from n/a through 4.18.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "Tribulant Software",
"product": "Newsletters",
"packageName": "newsletters-lite",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.18.1",
"changes": [
{
"at": "4.18.2",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-sql-injection-vulnerability-2?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Siyang Wu | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "Blind SQL Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Newsletters plugin to the latest available version (at least 4.18.2).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Newsletters plugin to the latest available version (at least 4.18.2)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124267.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124267",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:42.065Z",
"dateUpdated": "2026-11-13T15:08:42.065Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:42.065Z"
},
"title": "WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability",
"datePublic": "2026-11-11T14:14:16.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Gmail SMTP: from n/a through 1.2.3.23.</p>"
}
]
}
],
"affected": [
{
"vendor": "Noor Alam",
"product": "Gmail SMTP",
"packageName": "gmail-smtp",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.2.3.23",
"changes": [
{
"at": "1.2.3.24",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/gmail-smtp/vulnerability/wordpress-gmail-smtp-plugin-1-2-3-23-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Peter Tang | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Gmail SMTP plugin to the latest available version (at least 1.2.3.24).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Gmail SMTP plugin to the latest available version (at least 1.2.3.24)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124272.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124272",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.636Z",
"datePublished": "2026-11-13T15:08:41.860Z",
"dateUpdated": "2026-11-13T15:08:41.860Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:41.860Z"
},
"title": "WordPress Salon booking system plugin <= 10.31.14 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:13:52.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.14.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.<p>This issue affects Salon booking system: from n/a through 10.31.14.</p>"
}
]
}
],
"affected": [
{
"vendor": "Dimitri Grassi",
"product": "Salon booking system",
"packageName": "salon-booking-system",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "10.31.14",
"changes": [
{
"at": "10.31.15",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-31-14-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Pham Cong Lap (Clapboiz) of HPT VN | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Salon booking system plugin to the latest available version (at least 10.31.15).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Salon booking system plugin to the latest available version (at least 10.31.15)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124409.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124409",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T14:39:29.907Z",
"dateUpdated": "2026-11-13T14:40:31.659Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:40:31.659Z"
},
"title": "WordPress CURCY plugin <= 2.2.21 - Broken Access Control vulnerability",
"datePublic": "2026-11-13T14:39:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects CURCY: from n/a through 2.2.21.</p>"
}
]
}
],
"affected": [
{
"vendor": "VillaTheme",
"product": "CURCY",
"packageName": "woo-multi-currency",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.2.21",
"changes": [
{
"at": "2.2.22",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/woo-multi-currency/vulnerability/wordpress-curcy-plugin-2-2-21-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "hera-user | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress CURCY plugin to the latest available version (at least 2.2.22).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress CURCY plugin to the latest available version (at least 2.2.22)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124410.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124410",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:42.902Z",
"dateUpdated": "2026-11-13T15:08:42.902Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:42.902Z"
},
"title": "WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:17:06.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua: from n/a through 3.1.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua wplingua allows Stored XSS.<p>This issue affects Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua: from n/a through 3.1.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "wpLingua Translation Service",
"product": "Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua",
"packageName": "wplingua",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.1.1",
"changes": [
{
"at": "3.2.0",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wplingua/vulnerability/wordpress-translate-and-boost-seo-automatic-ai-translation-wplingua-plugin-3-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Alpaslan Fatih Sözer | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua plugin to the latest available version (at least 3.2.0).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua plugin to the latest available version (at least 3.2.0)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124412.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124412",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T14:40:28.529Z",
"dateUpdated": "2026-11-13T14:41:28.379Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:41:28.379Z"
},
"title": "WordPress Slim SEO plugin <= 4.11.5 - Content Injection vulnerability",
"datePublic": "2026-11-13T14:40:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.<p>This issue affects Slim SEO: from n/a through 4.11.5.</p>"
}
]
}
],
"affected": [
{
"vendor": "eLightUp",
"product": "Slim SEO",
"packageName": "slim-seo",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.11.5",
"changes": [
{
"at": "4.11.6",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/slim-seo/vulnerability/wordpress-slim-seo-plugin-4-11-5-content-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "neurotx | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Slim SEO plugin to the latest available version (at least 4.11.6).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Slim SEO plugin to the latest available version (at least 4.11.6)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124414.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124414",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:42.440Z",
"dateUpdated": "2026-11-13T15:08:42.440Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:42.440Z"
},
"title": "WordPress Broadcast Live Video plugin <= 7.3.15 - Broken Authentication vulnerability",
"datePublic": "2026-11-11T14:16:32.000Z",
"descriptions": [
{
"lang": "en",
"value": "Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.<p>This issue affects Broadcast Live Video: from n/a through 7.3.15.</p>"
}
]
}
],
"affected": [
{
"vendor": "VideoWhisper.com",
"product": "Broadcast Live Video",
"packageName": "videowhisper-live-streaming-integration",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "7.3.15",
"changes": [
{
"at": "7.3.16",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-3-15-broken-authentication-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "ashv4ni | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "Authentication Abuse"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Broadcast Live Video plugin to the latest available version (at least 7.3.16).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Broadcast Live Video plugin to the latest available version (at least 7.3.16)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124415.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124415",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:43.121Z",
"dateUpdated": "2026-11-13T15:08:43.121Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:43.121Z"
},
"title": "WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability",
"datePublic": "2026-11-11T14:17:27.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.<p>This issue affects Alex Reservations: from n/a through 2.4.8.</p>"
}
]
}
],
"affected": [
{
"vendor": "Alejandro",
"product": "Alex Reservations",
"packageName": "alex-reservations",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.4.8",
"changes": [
{
"at": "2.4.9",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/alex-reservations/vulnerability/wordpress-alex-reservations-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Jayant Kamble | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "SQL Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Alex Reservations plugin to the latest available version (at least 2.4.9).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Alex Reservations plugin to the latest available version (at least 2.4.9)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124418.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124418",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.331Z",
"datePublished": "2026-11-13T15:08:42.240Z",
"dateUpdated": "2026-11-13T15:08:42.240Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:42.240Z"
},
"title": "WordPress WP Job Portal plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:14:22.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.7.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.<p>This issue affects WP Job Portal: from n/a through 2.7.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "Ahmad",
"product": "WP Job Portal",
"packageName": "wp-job-portal",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.7.2",
"changes": [
{
"at": "2.8.0",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "elba.code | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress WP Job Portal plugin to the latest available version (at least 2.8.0).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress WP Job Portal plugin to the latest available version (at least 2.8.0)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124420.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124420",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.331Z",
"datePublished": "2026-11-13T15:08:41.418Z",
"dateUpdated": "2026-11-13T15:08:41.418Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:41.418Z"
},
"title": "WordPress Woody ad snippets plugin <= 2.7.10 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:12:30.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.<p>This issue affects Woody ad snippets: from n/a through 2.7.10.</p>"
}
]
}
],
"affected": [
{
"vendor": "Themeisle",
"product": "Woody ad snippets",
"packageName": "insert-php",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.7.10",
"changes": [
{
"at": "2.7.11",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/insert-php/vulnerability/wordpress-woody-ad-snippets-plugin-2-7-10-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "dzaku | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Woody ad snippets plugin to the latest available version (at least 2.7.11).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Woody ad snippets plugin to the latest available version (at least 2.7.11)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124965.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124965",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T15:06:57.634Z",
"datePublished": "2026-11-13T15:08:42.786Z",
"dateUpdated": "2026-11-13T15:08:42.786Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:42.786Z"
},
"title": "WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.16 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:16:47.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Stored XSS.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.16.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Stored XSS.<p>This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.16.</p>"
}
]
}
],
"affected": [
{
"vendor": "rtCamp Inc.",
"product": "rtMedia for WordPress, BuddyPress and bbPress",
"packageName": "buddypress-media",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.7.16",
"changes": [
{
"at": "4.7.17",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-16-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "AndrewN | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress rtMedia for WordPress, BuddyPress and bbPress plugin to the latest available version (at least 4.7.17).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress rtMedia for WordPress, BuddyPress and bbPress plugin to the latest available version (at least 4.7.17)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/124xxx/CVE-2026-124970.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124970",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T15:12:36.503Z",
"datePublished": "2026-11-13T15:08:40.764Z",
"dateUpdated": "2026-11-13T15:08:40.764Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:40.764Z"
},
"title": "WordPress WP BASE Booking plugin <= 6.5.2 - SQL Injection vulnerability",
"datePublic": "2026-11-11T14:08:13.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.<p>This issue affects WP BASE Booking: from n/a through 6.5.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "WP BASE",
"product": "WP BASE Booking",
"packageName": "wp-base-booking-of-appointments-services-and-events",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "6.5.2",
"changes": [
{
"at": "6.6.1",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Khanh Nguyen | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "Blind SQL Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress WP BASE Booking plugin to the latest available version (at least 6.6.1).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress WP BASE Booking plugin to the latest available version (at least 6.6.1)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125077.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-09T16:56:38.745Z",
"datePublished": "2026-11-09T23:45:23.342Z",
"dateUpdated": "2026-11-09T23:45:23.342Z"
"dateUpdated": "2026-11-13T14:56:04.386Z"
},
"containers": {
"cna": {
@@ -167,6 +167,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:55:21.444849Z",
"id": "CVE-2026-125077",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:56:04.386Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125086.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-09T17:15:42.556Z",
"datePublished": "2026-11-10T00:45:28.122Z",
"dateUpdated": "2026-11-10T00:45:28.122Z"
"dateUpdated": "2026-11-13T14:57:24.472Z"
},
"containers": {
"cna": {
@@ -168,6 +168,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:56:34.756360Z",
"id": "CVE-2026-125086",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:57:24.472Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125378.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:06.874Z",
"datePublished": "2026-11-09T23:27:47.499Z",
"dateUpdated": "2026-11-09T23:27:47.499Z"
"dateUpdated": "2026-11-13T14:15:14.685Z"
},
"containers": {
"cna": {
@@ -142,6 +142,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://hackmd.io/@hieuPenguinnn/cve-2026-125378-powerdns-admin-template-apply-missing-operator-authz",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:14:48.565167Z",
"id": "CVE-2026-125378",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:15:14.685Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125382.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:08.378Z",
"datePublished": "2026-11-09T23:27:50.340Z",
"dateUpdated": "2026-11-09T23:27:50.340Z"
"dateUpdated": "2026-11-13T14:17:05.418Z"
},
"containers": {
"cna": {
@@ -167,6 +167,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:16:32.371572Z",
"id": "CVE-2026-125382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:17:05.418Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125386.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:09.881Z",
"datePublished": "2026-11-09T23:27:53.127Z",
"dateUpdated": "2026-11-09T23:27:53.127Z"
"dateUpdated": "2026-11-13T14:21:03.426Z"
},
"containers": {
"cna": {
@@ -135,6 +135,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://hackmd.io/@hieuPenguinnn/cve-2026-121938-125386-langchain4j-aideepin-character-conversation-cross-user-idor",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:20:35.353749Z",
"id": "CVE-2026-125386",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:21:03.426Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125390.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:11.388Z",
"datePublished": "2026-11-09T23:27:55.891Z",
"dateUpdated": "2026-11-09T23:27:55.891Z"
"dateUpdated": "2026-11-13T14:48:20.431Z"
},
"containers": {
"cna": {
@@ -184,6 +184,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:46:46.422646Z",
"id": "CVE-2026-125390",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:48:20.431Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125394.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:12.932Z",
"datePublished": "2026-11-09T23:27:58.697Z",
"dateUpdated": "2026-11-09T23:27:58.697Z"
"dateUpdated": "2026-11-13T14:51:23.584Z"
},
"containers": {
"cna": {
@@ -155,6 +155,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:50:45.522228Z",
"id": "CVE-2026-125394",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:51:23.584Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125398.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:14.422Z",
"datePublished": "2026-11-09T23:28:01.464Z",
"dateUpdated": "2026-11-09T23:28:01.464Z"
"dateUpdated": "2026-11-13T14:52:58.810Z"
},
"containers": {
"cna": {
@@ -137,6 +137,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:52:38.628802Z",
"id": "CVE-2026-125398",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:52:58.810Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125406.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:17.371Z",
"datePublished": "2026-11-09T23:28:07.044Z",
"dateUpdated": "2026-11-09T23:28:07.044Z"
"dateUpdated": "2026-11-13T14:55:00.856Z"
},
"containers": {
"cna": {
@@ -160,6 +160,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T14:54:34.769856Z",
"id": "CVE-2026-125406",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:55:00.856Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125432.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125432",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.520Z",
"datePublished": "2026-11-13T15:08:43.468Z",
"dateUpdated": "2026-11-13T15:08:43.468Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:43.468Z"
},
"title": "WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability",
"datePublic": "2026-11-11T14:18:35.000Z",
"descriptions": [
{
"lang": "en",
"value": "Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.<p>This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.</p>"
}
]
}
],
"affected": [
{
"vendor": "RelyWP",
"product": "reCAPTCHA for WooCommerce",
"packageName": "recaptcha-woo",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.4.7",
"changes": [
{
"at": "1.5.0",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/recaptcha-woo/vulnerability/wordpress-recaptcha-for-woocommerce-plugin-1-4-7-broken-authentication-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Peter Tang | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "Password Recovery Exploitation"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress reCAPTCHA for WooCommerce plugin to the latest available version (at least 1.5.0).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress reCAPTCHA for WooCommerce plugin to the latest available version (at least 1.5.0)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125440.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125440",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.521Z",
"datePublished": "2026-11-13T14:41:09.092Z",
"dateUpdated": "2026-11-13T14:41:17.329Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:41:17.329Z"
},
"title": "WordPress s2Member plugin <= 261106 - Content Injection vulnerability",
"datePublic": "2026-11-13T14:40:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through 261106.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.<p>This issue affects s2Member: from n/a through 261106.</p>"
}
]
}
],
"affected": [
{
"vendor": "Cristián Lávaque",
"product": "s2Member",
"packageName": "s2member",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "261106",
"changes": [
{
"at": "261110",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/s2member/vulnerability/wordpress-s2member-plugin-261106-content-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Yusuf Ozturk | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress s2Member plugin to the latest available version (at least 261110).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress s2Member plugin to the latest available version (at least 261110)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125452.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125452",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.522Z",
"datePublished": "2026-11-13T15:08:38.883Z",
"dateUpdated": "2026-11-13T15:08:38.883Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:38.883Z"
},
"title": "WordPress WPJAM Basic plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:02:55.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows Reflected XSS.This issue affects WPJAM Basic: from n/a through 7.1.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows Reflected XSS.<p>This issue affects WPJAM Basic: from n/a through 7.1.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "Denishua",
"product": "WPJAM Basic",
"packageName": "wpjam-basic",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "7.1.2",
"changes": [
{
"at": "7.1.4",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "John Ryan Albon | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress WPJAM Basic plugin to the latest available version (at least 7.1.4).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress WPJAM Basic plugin to the latest available version (at least 7.1.4)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125706.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-10T10:31:34.391Z",
"datePublished": "2026-11-10T11:23:11.334Z",
"dateUpdated": "2026-11-12T17:27:40.860Z"
"dateUpdated": "2026-11-13T15:07:01.064Z"
},
"containers": {
"cna": {
@@ -172,6 +172,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:05:09.932598Z",
"id": "CVE-2026-125706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:07:01.064Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125715.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "samsung.tv_appliance",
"dateReserved": "2026-11-10T11:05:13.190Z",
"datePublished": "2026-11-10T11:21:20.300Z",
"dateUpdated": "2026-11-10T11:21:20.300Z"
"dateUpdated": "2026-11-13T14:31:56.007Z"
},
"containers": {
"cna": {
@@ -86,6 +86,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:18:24.511845Z",
"id": "CVE-2026-125715",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T14:31:56.007Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125747.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T12:35:57.791Z",
"datePublished": "2026-11-10T15:22:44.626Z",
"dateUpdated": "2026-11-10T15:22:44.626Z"
"dateUpdated": "2026-11-13T15:14:30.723Z"
},
"containers": {
"cna": {
@@ -136,6 +136,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://hackmd.io/@hieund/zentaopms-build-missing-object-authorization-idor",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:13:41.940100Z",
"id": "CVE-2026-125747",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:14:30.723Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125751.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T12:36:07.711Z",
"datePublished": "2026-11-10T15:22:47.272Z",
"dateUpdated": "2026-11-10T15:22:47.272Z"
"dateUpdated": "2026-11-13T15:18:00.883Z"
},
"containers": {
"cna": {
@@ -137,6 +137,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:17:34.583365Z",
"id": "CVE-2026-125751",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:18:00.883Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125783.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125783",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.984Z",
"datePublished": "2026-11-13T15:08:41.100Z",
"dateUpdated": "2026-11-13T15:08:41.100Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:41.100Z"
},
"title": "WordPress Custom Post Types and Custom Fields creator – WCK plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:12:18.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.This issue affects Custom Post Types and Custom Fields creator – WCK: from n/a through 2.4.0.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.<p>This issue affects Custom Post Types and Custom Fields creator – WCK: from n/a through 2.4.0.</p>"
}
]
}
],
"affected": [
{
"vendor": "madalin.ungureanu",
"product": "Custom Post Types and Custom Fields creator – WCK",
"packageName": "wck-custom-fields-and-custom-post-types-creator",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.4.0",
"changes": [
{
"at": "2.4.2",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wck-custom-fields-and-custom-post-types-creator/vulnerability/wordpress-custom-post-types-and-custom-fields-creator-wck-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Viet Tin | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Custom Post Types and Custom Fields creator – WCK plugin to the latest available version (at least 2.4.2).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Custom Post Types and Custom Fields creator – WCK plugin to the latest available version (at least 2.4.2)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125792.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125792",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.985Z",
"datePublished": "2026-11-13T14:44:46.614Z",
"dateUpdated": "2026-11-13T14:45:47.454Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:45:47.454Z"
},
"title": "WordPress Church Admin plugin <= 5.1.8 - Broken Access Control vulnerability",
"datePublic": "2026-11-13T14:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Church Admin: from n/a through 5.1.8.</p>"
}
]
}
],
"affected": [
{
"vendor": "Andy Moyle",
"product": "Church Admin",
"packageName": "church-admin",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "5.1.8",
"changes": [
{
"at": "5.1.9",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-1-8-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "João Paulo de Oliveira | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Church Admin plugin to the latest available version (at least 5.1.9).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Church Admin plugin to the latest available version (at least 5.1.9)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125794.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125794",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.985Z",
"datePublished": "2026-11-13T14:45:32.012Z",
"dateUpdated": "2026-11-13T14:46:32.964Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:46:32.964Z"
},
"title": "WordPress Extension for Leaflet Map plugin <= 6.1.1 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-13T14:45:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extension for Leaflet Map: from n/a through 6.1.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.<p>This issue affects Extension for Leaflet Map: from n/a through 6.1.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "hupe13",
"product": "Extension for Leaflet Map",
"packageName": "extensions-leaflet-map",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "6.1.1",
"changes": [
{
"at": "6.1.2",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/extensions-leaflet-map/vulnerability/wordpress-extension-for-leaflet-map-plugin-6-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Peter Tang | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Extension for Leaflet Map plugin to the latest available version (at least 6.1.2).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Extension for Leaflet Map plugin to the latest available version (at least 6.1.2)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125802.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125802",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.986Z",
"datePublished": "2026-11-13T14:49:06.308Z",
"dateUpdated": "2026-11-13T14:49:06.755Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:49:06.755Z"
},
"title": "WordPress Spectra plugin <= 2.20.5 - Sensitive Data Exposure vulnerability",
"datePublic": "2026-11-13T14:48:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.<p>This issue affects Spectra: from n/a through 2.20.5.</p>"
}
]
}
],
"affected": [
{
"vendor": "Brainstorm Force",
"product": "Spectra",
"packageName": "ultimate-addons-for-gutenberg",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.20.5",
"changes": [
{
"at": "2.20.6",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-sensitive-data-exposure-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Malvin Valerian Gultom | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "Retrieve Embedded Sensitive Data"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Spectra plugin to the latest available version (at least 2.20.6).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Spectra plugin to the latest available version (at least 2.20.6)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125807.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125807",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.987Z",
"datePublished": "2026-11-13T14:38:08.242Z",
"dateUpdated": "2026-11-13T14:38:08.621Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:38:08.621Z"
},
"title": "WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-13T14:37:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.<p>This issue affects HT Mega: from n/a through 3.2.8.</p>"
}
]
}
],
"affected": [
{
"vendor": "HTMega",
"product": "HT Mega",
"packageName": "ht-mega-for-elementor",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.2.8",
"changes": [
{
"at": "3.2.9",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-3-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "nh4tvd | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress HT Mega plugin to the latest available version (at least 3.2.9).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress HT Mega plugin to the latest available version (at least 3.2.9)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125808.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125808",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.987Z",
"datePublished": "2026-11-13T14:37:19.654Z",
"dateUpdated": "2026-11-13T14:37:26.063Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:37:26.063Z"
},
"title": "WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability",
"datePublic": "2026-11-13T14:37:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects HT Mega: from n/a through 3.2.8.</p>"
}
]
}
],
"affected": [
{
"vendor": "HTMega",
"product": "HT Mega",
"packageName": "ht-mega-for-elementor",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.2.8",
"changes": [
{
"at": "3.2.9",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-3-2-8-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Malvin Valerian Gultom | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress HT Mega plugin to the latest available version (at least 3.2.9).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress HT Mega plugin to the latest available version (at least 3.2.9)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125809.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125809",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:41:21.896Z",
"dateUpdated": "2026-11-13T14:42:22.792Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:42:22.792Z"
},
"title": "WordPress myCred plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-13T14:41:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.<p>This issue affects myCred: from n/a through 4.0.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "myCred",
"product": "myCred",
"packageName": "mycred",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.0.2",
"changes": [
{
"at": "4.0.3",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "dzaku | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.3).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.3)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125810.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125810",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:41:40.114Z",
"dateUpdated": "2026-11-13T14:42:41.233Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:42:41.233Z"
},
"title": "WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability",
"datePublic": "2026-11-13T14:41:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects myCred: from n/a through 4.0.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "myCred",
"product": "myCred",
"packageName": "mycred",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.0.2",
"changes": [
{
"at": "4.0.3",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability-7?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "dzaku | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.3).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.3)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125811.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125811",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:42:07.515Z",
"dateUpdated": "2026-11-13T14:43:08.685Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:43:08.685Z"
},
"title": "WordPress myCred plugin <= 4.0.2 - SQL Injection vulnerability",
"datePublic": "2026-11-13T14:41:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.<p>This issue affects myCred: from n/a through 4.0.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "myCred",
"product": "myCred",
"packageName": "mycred",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.0.2",
"changes": [
{
"at": "4.0.3",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-sql-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "dzaku | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "Blind SQL Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.3).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.3)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125814.json
+3 -3
View File
@@ -8,17 +8,17 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T12:58:27.612Z",
"dateUpdated": "2026-11-13T12:59:27.837Z"
"dateUpdated": "2026-11-13T14:30:05.493Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T12:59:27.837Z"
"dateUpdated": "2026-11-13T14:30:05.493Z"
},
"title": "WordPress Product Feed PRO for WooCommerce plugin <= 13.5.8 - Content Injection vulnerability",
"datePublic": "2026-11-13T12:59:27.673Z",
"datePublic": "2026-11-13T14:15:00.000Z",
"descriptions": [
{
"lang": "en",
data/2026/125xxx/CVE-2026-125819.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125819",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.989Z",
"datePublished": "2026-11-13T14:36:42.484Z",
"dateUpdated": "2026-11-13T14:37:43.070Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:37:43.070Z"
},
"title": "WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability",
"datePublic": "2026-11-13T14:36:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Gutenberg Blocks: from n/a through 3.7.6.</p>"
}
]
}
],
"affected": [
{
"vendor": "PublishPress",
"product": "Gutenberg Blocks",
"packageName": "advanced-gutenberg",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.7.6",
"changes": [
{
"at": "3.7.7",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-plugin-3-7-6-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Malvin Valerian Gultom | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Gutenberg Blocks plugin to the latest available version (at least 3.7.7).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Gutenberg Blocks plugin to the latest available version (at least 3.7.7)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125821.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125821",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:40:09.916Z",
"dateUpdated": "2026-11-13T14:41:13.773Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:41:13.773Z"
},
"title": "WordPress MapSVG plugin <= 9.0.4 - Content Injection vulnerability",
"datePublic": "2026-11-13T14:39:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through 9.0.4.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.<p>This issue affects MapSVG: from n/a through 9.0.4.</p>"
}
]
}
],
"affected": [
{
"vendor": "PT Norther Lights Production",
"product": "MapSVG",
"packageName": "mapsvg-lite-interactive-vector-maps",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "9.0.4",
"changes": [
{
"at": "9.0.5",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-9-0-4-content-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "SEONGMIN JO, IT Auditor in S.Korea. | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress MapSVG plugin to the latest available version (at least 9.0.5).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress MapSVG plugin to the latest available version (at least 9.0.5)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125824.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125824",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:37:01.016Z",
"dateUpdated": "2026-11-13T14:38:01.756Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:38:01.756Z"
},
"title": "WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-13T14:36:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.<p>This issue affects WP Go Maps: from n/a through 10.1.10.</p>"
}
]
}
],
"affected": [
{
"vendor": "WP Go Maps",
"product": "WP Go Maps",
"packageName": "wp-google-maps",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "10.1.10",
"changes": [
{
"at": "10.1.11",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-google-maps/vulnerability/wordpress-wp-go-maps-plugin-10-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Khanh Nguyen | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress WP Go Maps plugin to the latest available version (at least 10.1.11).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress WP Go Maps plugin to the latest available version (at least 10.1.11)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125825.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125825",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:48:42.721Z",
"dateUpdated": "2026-11-13T14:49:43.300Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:49:43.300Z"
},
"title": "WordPress RepairBuddy plugin <= 4.1236 - Broken Access Control vulnerability",
"datePublic": "2026-11-13T14:48:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1236.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects RepairBuddy: from n/a through 4.1236.</p>"
}
]
}
],
"affected": [
{
"vendor": "Webful Creations",
"product": "RepairBuddy",
"packageName": "computer-repair-shop",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "4.1236",
"changes": [
{
"at": "4.1237",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1236-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Nikita Mateo Volovik | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress RepairBuddy plugin to the latest available version (at least 4.1237).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress RepairBuddy plugin to the latest available version (at least 4.1237)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125827.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125827",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:42:34.956Z",
"dateUpdated": "2026-11-13T14:43:36.205Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:43:36.205Z"
},
"title": "WordPress Event Tickets plugin <= 5.31.0 - Broken Access Control vulnerability",
"datePublic": "2026-11-13T14:42:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Event Tickets: from n/a through 5.31.0.</p>"
}
]
}
],
"affected": [
{
"vendor": "Liquid Web / StellarWP",
"product": "Event Tickets",
"packageName": "event-tickets",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "5.31.0",
"changes": [
{
"at": "5.31.1",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-31-0-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "Phuong Nguyen | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Event Tickets plugin to the latest available version (at least 5.31.1).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Event Tickets plugin to the latest available version (at least 5.31.1)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125831.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125831",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:44:06.958Z",
"dateUpdated": "2026-11-13T14:45:08.045Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:45:08.045Z"
},
"title": "WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-13T14:43:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.<p>This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.2.</p>"
}
]
}
],
"affected": [
{
"vendor": "IdeaBox Creations",
"product": "PowerPack Lite for Beaver Builder",
"packageName": "powerpack-addon-for-beaver-builder",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.3.2",
"changes": [
{
"at": "1.3.3",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/powerpack-addon-for-beaver-builder/vulnerability/wordpress-powerpack-lite-for-beaver-builder-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "henise | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress PowerPack Lite for Beaver Builder plugin to the latest available version (at least 1.3.3).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress PowerPack Lite for Beaver Builder plugin to the latest available version (at least 1.3.3)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125834.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125834",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T14:43:27.039Z",
"dateUpdated": "2026-11-13T14:44:28.214Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:44:28.214Z"
},
"title": "WordPress Imagify plugin <= 2.3.4 - Broken Access Control vulnerability",
"datePublic": "2026-11-13T14:43:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Imagify: from n/a through 2.3.4.</p>"
}
]
}
],
"affected": [
{
"vendor": "WP Media",
"product": "Imagify",
"packageName": "imagify",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.3.4",
"changes": [
{
"at": "2.3.5",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/imagify/vulnerability/wordpress-imagify-plugin-2-3-4-broken-access-control-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "amonm | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Imagify plugin to the latest available version (at least 2.3.5).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress Imagify plugin to the latest available version (at least 2.3.5)."
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125835.json
+136
View File
@@ -0,0 +1,136 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125835",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T14:39:51.449Z",
"dateUpdated": "2026-11-13T14:40:53.481Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T14:40:53.481Z"
},
"title": "WordPress JetTabs plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-13T14:39:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.<p>This issue affects JetTabs: from n/a through 2.3.5.</p>"
}
]
}
],
"affected": [
{
"vendor": "Crocoblock",
"product": "JetTabs",
"packageName": "jet-tabs",
"collectionURL": "https://crocoblock.com",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.3.5",
"changes": [
{
"at": "2.3.5.1",
"status": "unaffected"
}
]
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "nh4tvd | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress JetTabs plugin to the latest available version (at least 2.3.5.1).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Update the WordPress JetTabs plugin to the latest available version (at least 2.3.5.1)."
}
]
}
]
}
}
}
data/2026/125xxx/CVE-2026-125837.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125837",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T15:08:39.612Z",
"dateUpdated": "2026-11-13T15:08:39.612Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:39.612Z"
},
"title": "WordPress Make theme <= 1.10.10 - Cross Site Scripting (XSS) vulnerability",
"datePublic": "2026-11-11T14:04:37.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry Make make allows Reflected XSS.This issue affects Make: from n/a through 1.10.10.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry Make make allows Reflected XSS.<p>This issue affects Make: from n/a through 1.10.10.</p>"
}
]
}
],
"affected": [
{
"vendor": "thethemefoundry",
"product": "Make",
"packageName": "make",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "1.10.10"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/make/vulnerability/wordpress-make-theme-1-10-10-cross-site-scripting-xss-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "dzaku | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS"
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
data/2026/125xxx/CVE-2026-125851.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125851",
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"state": "PUBLISHED",
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:40.381Z",
"dateUpdated": "2026-11-13T15:08:40.381Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-11-13T15:08:40.381Z"
},
"title": "WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability",
"datePublic": "2026-11-11T14:07:18.000Z",
"descriptions": [
{
"lang": "en",
"value": "Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.<p>This issue affects Hotel Booking Lite: from n/a through 2.5.1.</p>"
}
]
}
],
"affected": [
{
"vendor": "themagnifico52",
"product": "Hotel Booking Lite",
"packageName": "hotel-booking-lite",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "2.5.1"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/hotel-booking-lite/vulnerability/wordpress-hotel-booking-lite-theme-2-5-1-arbitrary-file-upload-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
]
}
],
"credits": [
{
"lang": "en",
"value": "beopseong.kim | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-650",
"descriptions": [
{
"lang": "en",
"value": "Upload a Web Shell to a Web Server"
}
]
}
],
"tags": [
"x_open-source"
]
}
}
}
Loaded 100 of 214 files, more files were not shown because too many files have changed in this diff. Show more