VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-12T20:39:46Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-12 21:39:51 +01:00
1 parent 05e8212e38
commit f9aa29d28e
475 files changed
+31507 -22421
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2023/39xxx/CVE-2023-39970.json
+4 -4
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2023-39970",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
@@ -8,7 +8,7 @@
"assignerShortName": "Joomla",
"dateReserved": "2023-08-07T16:52:01.494Z",
"datePublished": "2023-08-17T20:06:32.953Z",
"dateUpdated": "2024-10-20T04:33:26.300Z"
"dateUpdated": "2026-11-12T18:07:09.623Z"
},
"containers": {
"cna": {
@@ -18,7 +18,7 @@
"defaultStatus": "unaffected",
"packageName": "com_acymailing",
"product": "AcyMailing component for Joomla",
"vendor": "acymailing.com",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
@@ -73,7 +73,7 @@
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2024-10-20T04:33:26.300Z"
"dateUpdated": "2026-11-12T18:07:09.623Z"
},
"references": [
{
data/2023/39xxx/CVE-2023-39971.json
+4 -4
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2023-39971",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
@@ -8,7 +8,7 @@
"assignerShortName": "Joomla",
"dateReserved": "2023-08-07T16:52:01.494Z",
"datePublished": "2023-08-17T20:06:40.974Z",
"dateUpdated": "2024-10-20T04:33:27.361Z"
"dateUpdated": "2026-11-12T18:00:52.147Z"
},
"containers": {
"cna": {
@@ -18,7 +18,7 @@
"defaultStatus": "unaffected",
"packageName": "com_acymailing",
"product": "AcyMailing Enterprise component for Joomla",
"vendor": "acymailing.com",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
@@ -73,7 +73,7 @@
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2024-10-20T04:33:27.361Z"
"dateUpdated": "2026-11-12T18:00:52.147Z"
},
"references": [
{
data/2023/39xxx/CVE-2023-39972.json
+4 -4
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2023-39972",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
@@ -8,7 +8,7 @@
"assignerShortName": "Joomla",
"dateReserved": "2023-08-07T16:52:01.494Z",
"datePublished": "2023-08-17T20:06:39.150Z",
"dateUpdated": "2024-10-20T04:33:20.711Z"
"dateUpdated": "2026-11-12T17:55:46.088Z"
},
"containers": {
"cna": {
@@ -18,7 +18,7 @@
"defaultStatus": "unaffected",
"packageName": "com_acymailing",
"product": "AcyMailing Enterprise component for Joomla",
"vendor": "acymailing.com",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
@@ -73,7 +73,7 @@
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2024-10-20T04:33:20.711Z"
"dateUpdated": "2026-11-12T17:55:46.088Z"
},
"references": [
{
data/2023/39xxx/CVE-2023-39973.json
+4 -4
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2023-39973",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
@@ -8,7 +8,7 @@
"assignerShortName": "Joomla",
"dateReserved": "2023-08-07T16:52:01.494Z",
"datePublished": "2023-08-17T20:06:35.442Z",
"dateUpdated": "2024-10-20T04:33:20.343Z"
"dateUpdated": "2026-11-12T17:59:32.219Z"
},
"containers": {
"cna": {
@@ -18,7 +18,7 @@
"defaultStatus": "unaffected",
"packageName": "com_acymailing",
"product": "AcyMailing Enterprise component for Joomla",
"vendor": "acymailing.com",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
@@ -73,7 +73,7 @@
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2024-10-20T04:33:20.343Z"
"dateUpdated": "2026-11-12T17:59:32.219Z"
},
"references": [
{
data/2023/39xxx/CVE-2023-39974.json
+4 -4
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2023-39974",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
@@ -8,7 +8,7 @@
"assignerShortName": "Joomla",
"dateReserved": "2023-08-07T16:52:01.494Z",
"datePublished": "2023-08-17T20:06:39.321Z",
"dateUpdated": "2024-10-20T04:33:25.578Z"
"dateUpdated": "2026-11-12T18:07:34.398Z"
},
"containers": {
"cna": {
@@ -18,7 +18,7 @@
"defaultStatus": "unaffected",
"packageName": "com_acymailing",
"product": "AcyMailing Enterprise component for Joomla",
"vendor": "acymailing.com",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
@@ -73,7 +73,7 @@
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2024-10-20T04:33:25.578Z"
"dateUpdated": "2026-11-12T18:07:34.398Z"
},
"references": [
{
data/2024/21xxx/CVE-2024-21954.json
+133
View File
@@ -0,0 +1,133 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-21954",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2024-01-03T16:43:26.977Z",
"datePublished": "2026-11-12T19:06:05.496Z",
"dateUpdated": "2026-11-12T19:06:05.496Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:06:05.496Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 7003 Series Processors",
"versions": [
{
"version": "MilanPI-SP3_1.0.0.J",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9004 Series Processors",
"versions": [
{
"version": "GenoaPI_1.0.0.H",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 7003 Series Processors",
"versions": [
{
"version": "EmbMilanPI-SP3 1.0.0.D",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")",
"versions": [
{
"version": "EmbGenoaPI-SP5 1.0.0.D",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:04:33.652Z",
"descriptions": [
{
"lang": "en",
"value": "Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Cache (ATC), potentially resulting in denial of service.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Cache (ATC), potentially resulting in denial of service.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3052.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2024/21xxx/CVE-2024-21963.json
+658
View File
@@ -0,0 +1,658 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-21963",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2024-01-03T16:43:28.698Z",
"datePublished": "2026-11-12T19:23:50.871Z",
"dateUpdated": "2026-11-12T20:05:05.456Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:23:50.871Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 7003 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 7002 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9004 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 7001 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 4004 Series Processors",
"versions": [
{
"version": "ComboAM5PI 1.2.0.3g",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 8004 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 4005 Series Processors",
"versions": [
{
"version": "ComboAM5PI 1.2.0.3g",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 8005 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors",
"versions": [
{
"version": "ChagallWSPI-sWRX8 1.0.0.D",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "CezannePI-FP6_1.0.1.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ 7000 WX-Series Processors",
"versions": [
{
"version": "StormPeakPI-SP6_1.1.0.0k",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000HX Series Processors",
"versions": [
{
"version": "FireRangeFL1PI 1.0.0.0c",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 300 Series Processors",
"versions": [
{
"version": "StrixKrackanPI-FP8_1.1.0.0d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Max 300 Series Processors",
"versions": [
{
"version": "StrixHaloPI-FP11_1.0.0.1c",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics",
"versions": [
{
"version": "ComboAM4v2PI 1.2.0.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI 1.2.0.3g",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "PhoenixPI-FP8-FP7_1.2.0.0e",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ 9000 Series",
"versions": [
{
"version": "ShimadaPeakPI-SP6 1.0.0.1b",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "PhoenixPI-FP8-FP7_1.2.0.0e",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Z2 Series Processors",
"versions": [
{
"version": "PhoenixPI-FP8-FP7_1.2.0.0e",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "RenoirPI-FP6 1.0.0.Ed",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics",
"versions": [
{
"version": "RembrandtPI-FP7_1.0.0.Bf",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors",
"versions": [
{
"version": "ChagallWSPI-sWRX8 1.0.0.D",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics",
"versions": [
{
"version": "MendocinoPI-FT6_1.0.0.7f",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "DragonRangeFL1PI 1.0.0.3j",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 300 Series Processors",
"versions": [
{
"version": "StrixKrackanPI-FP8_1.1.0.2.b",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors",
"versions": [
{
"version": "StormPeakPI-SP6 1.0.0.1m",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 4000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM4v2PI 1.2.0.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM4v2PI 1.2.0.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 2000 Mobile Processors",
"versions": [
{
"version": "ComboAM4v2PI 1.2.0.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 8000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI 1.2.0.3g",
"status": "unaffected"
},
{
"version": "ComboAM5PI 1.1.0.3d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Z1 Series Processors",
"versions": [
{
"version": "ComboAM5PI 1.2.0.3g",
"status": "unaffected"
},
{
"version": "ComboAM5 1.0.0.c",
"status": "unaffected"
},
{
"version": "ComboAM5PI 1.1.0.3d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI 1.2.0.3g",
"status": "unaffected"
},
{
"version": "ComboAM5 1.0.0.c",
"status": "unaffected"
},
{
"version": "ComboAM5PI 1.1.0.3d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 3000 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 7002 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 7003 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 7000 Series Processors",
"versions": [
{
"version": "EmbeddedAM5PI 1.0.0.5",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 8000 Series Processors",
"versions": [
{
"version": "EmbeddedPhoenixPI-FP7r2_1.0.0.3",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 5000 Series Processors",
"versions": [
{
"version": "EmbAM4PI 1.0.0.9",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V2000A Series Processors",
"versions": [
{
"version": "EmbeddedV2KAPI-FP6 1.0.0.A",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V2000 Series Processors",
"versions": [
{
"version": "EmbeddedPI-FP6_1.0.0.D",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V3000 Series Processors",
"versions": [
{
"version": "Embedded-PI_FP7r2 1.0.1.1",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen Embedded V3000 EDKII Series Processors",
"versions": [
{
"version": "Embedded-PI_FP7r2 1.0.0.D",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 8004 Series Processors",
"versions": [
{
"version": "Linux kernel upstream",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:22:47.184Z",
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potentially cause a host crash leading to loss of availability.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potentially cause a host crash leading to loss of availability.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"
},
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3060.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
},
"adp": [
{
"title": "CVE Program Container",
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-524.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/10/21"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-11-12T20:05:05.456Z"
}
}
]
}
}
data/2024/36xxx/CVE-2024-36344.json
+687
View File
@@ -0,0 +1,687 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-36344",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2024-05-23T19:44:47.200Z",
"datePublished": "2026-11-12T19:19:23.515Z",
"dateUpdated": "2026-11-12T19:19:23.515Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:19:23.515Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 4004 Series Processors",
"versions": [
{
"version": "ComboAM5PI_1.0.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"version": "TurinPI 1.0.0.6",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "RenoirPI-FP6_1.0.0.Ec",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics",
"versions": [
{
"version": "RembrandtPI-FP7_1.0.0.BD",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "PicassoPI-FP5_1.0.1.2c",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "PhoenixPI-FP8-FP7_1.2.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics",
"versions": [
{
"version": "MendocinoPI-FT6_1.0.0.7c",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "DragonRangeFL1 1.0.0.3h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI_1.0.0.B",
"status": "unaffected"
},
{
"version": "ComboAM5PI 1.1.0.3d",
"status": "unaffected"
},
{
"version": "ComboAM5PI 1.2.0.3d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 3000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM4v2 1.2.0.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors",
"versions": [
{
"version": "ChagallWSPI-sWRX8 1.0.0.C",
"status": "unaffected"
},
{
"version": "CastlePeakWSPI-sWRX8 1.0.0.H",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "CezannePI-FP6_1.0.1.1c",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ 3000 Processors",
"versions": [
{
"version": "CastlePeakPI-SP3r3_1.0.0.F",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors",
"versions": [
{
"version": "ChagallWSPI-sWRX8 1.0.0.C",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ 7000 Processors",
"versions": [
{
"version": "StormPeakPI-SP6_1.1.0.0j",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors",
"versions": [
{
"version": "StormPeakPI-SP6_1.0.0.1l",
"status": "unaffected"
},
{
"version": "StormPeakPI-SP6_1.1.0.0j",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 8000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI 1.1.0.3d",
"status": "unaffected"
},
{
"version": "ComboAM5 1.2.0.3d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5 1.2.0.3d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "CezannePI-FP6_1.0.1.1c",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "CezannePI-FP6_1.0.1.1c",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 4000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM4v2PI_1.2.0.F",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM4v2 1.2.0.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics",
"versions": [
{
"version": "ComboAM4v2PI_1.2.0.F",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 3000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM4PI 1.0.0.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "PhoenixPI-FP8-FP7_1.2.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics",
"versions": [
{
"version": "PicassoPI-FP5_1.0.1.2c",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics",
"versions": [
{
"version": "RembrandtPI-FP7_1.0.0.BD",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded R1000 Series Processors",
"versions": [
{
"version": "EmbeddedPI-FP5 1211",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded R2000 Series Processors",
"versions": [
{
"version": "EmbeddedR2KPI-FP5 1006",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")",
"versions": [
{
"version": "EmbeddedPI-FP5 1211",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 5000 Series Processors",
"versions": [
{
"version": "EmbAM4PI 1.0.0.9",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 7000 Series Processors",
"versions": [
{
"version": "EmbeddedAM5PI 1.0.0.4​",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V2000 Series Processors",
"versions": [
{
"version": "EmbeddedPI-FP6_1.0.0.C",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V3000 Series Processors",
"versions": [
{
"version": "Embedded-PI_FP7r2 1011",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"version": "EmbTurinPI-SP5_1.0.0.1",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 8000 Series Processors",
"versions": [
{
"version": "EmbeddedPhoenixPI-FP7r2_1.0.0.2",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 9000 Series Processors",
"versions": [
{
"version": "EmbeddedAM5PI 1.0.0.5",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ RX 5000 Series Graphics Products",
"versions": [
{
"version": "AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ PRO W5000 Series Graphics Products",
"versions": [
{
"version": "AMD Software: PRO Edition 25.Q2 (25.10.10)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ RX 6000 Series Graphics Products",
"versions": [
{
"version": "AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ RX 7000 Series Graphics Products",
"versions": [
{
"version": "AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ PRO W6000 Series Graphics Products",
"versions": [
{
"version": "AMD Software: PRO Edition 25.Q2 (25.10.10)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ PRO W7000 Series Graphics Products",
"versions": [
{
"version": "AMD Software: PRO Edition 25.Q2 (25.10.10)",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Instinct™ MI210",
"versions": [
{
"version": "AMDGPU Driver 25.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Instinct™ MI250",
"versions": [
{
"version": "AMDGPU Driver 25.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Instinct™ MI300A",
"versions": [
{
"version": "AMDGPU Driver 25.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Instinct™ MI300X",
"versions": [
{
"version": "AMDGPU Driver 25.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Instinct™ MI308",
"versions": [
{
"version": "AMDGPU Driver 25.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Instinct™ MI325X",
"versions": [
{
"version": "AMDGPU Driver 25.10",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ PRO V520",
"versions": [
{
"version": "Contact your AMD Customer Engineering representative",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ PRO V620",
"versions": [
{
"version": "Contact your AMD Customer Engineering representative",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Radeon™ PRO V710",
"versions": [
{
"version": "Contact your AMD Customer Engineering representative",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:18:36.039Z",
"descriptions": [
{
"lang": "en",
"value": "Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the Trusted Execution Environment (TEE) interface or Trusted Application (TA) to cause an out-of-bounds write, potentially resulting in a loss of platform integrity or denial of service.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the Trusted Execution Environment (TEE) interface or Trusted Application (TA) to cause an out-of-bounds write, potentially resulting in a loss of platform integrity or denial of service.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"
},
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6028.html"
},
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3057.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2024/36xxx/CVE-2024-36350.json
+99 -173
View File
@@ -8,317 +8,223 @@
"assignerShortName": "AMD",
"dateReserved": "2024-05-23T19:44:50.000Z",
"datePublished": "2025-07-08T16:56:39.834Z",
"dateUpdated": "2025-11-04T21:08:39.481Z"
"dateUpdated": "2026-11-12T19:32:09.610Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:32:09.610Z"
},
"affected": [
{
"defaultStatus": "affected",
"product": "AMD EPYC™ 7003 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "MilanPI 1.0.0.G + OS Updates"
"version": "TurinPI_1.0.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ 9004 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ 8005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "GenoaPI 1.0.0.E + OS Updates"
"version": "TurinPI_1.0.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ 8004 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ 4005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "GenoaPI 1.0.0.E + OS Updates"
"version": "ComboAM5PI 1.3.0.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ 9V64H Processor",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000HX Series Processors",
"versions": [
{
"status": "unaffected",
"version": "MI300PI 1.0.0.7 + OS Updates"
"version": "FireRangeFL1 PI-1.0.0.0i",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 5000 Series Desktop Processors",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 300 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "ComboAM4v2PI 1.2.0.E + OS Updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "ComboAM4v2PI 1.2.0.E + OS Updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7000 Series Desktop Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "ComboAM5PI 1.2.0.3 + OS Updates"
"version": "StrixKrackanPI-FP8_1.1.0.0h",
"status": "unaffected"
},
{
"status": "unaffected",
"version": "ComboAM5PI 1.0.0.a+ OS Updates"
"version": "StrixKrackanPI-FP8_1.1.0.2g",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI 1.2.0.3l",
"status": "unaffected"
},
{
"status": "unaffected",
"version": "ComboAM5PI 1.1.0.3c+ OS Updates"
"version": "ComboAM5PI 1.3.0.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Max 400 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "ComboAM5PI 1.2.0.3 + OS Updates"
},
{
"status": "unaffected",
"version": "ComboAM5PI 1.1.0.3c+ OS Updates"
"version": "GorgonHaloPI-FP11_1.0.0.0a",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Max 300 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "StormPeakPI-SP6 1.1.0.0i + OS Updates"
},
{
"status": "unaffected",
"version": "StormPeakPI-SP6 1.0.0.1k + OS Updates"
"version": "StrixHalo PI-FP11_1.0.0.2d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ AI400 Series Desktop Processors",
"versions": [
{
"status": "unaffected",
"version": "RembrandtPI-FP7 1.0.0.Bb + OS Updates"
"version": "ComboAM5PI 1.3.0.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Z2 Extreme",
"versions": [
{
"status": "unaffected",
"version": "RembrandtPI-FP7 1.0.0.Bb + OS Updates"
"version": "GorgonPI-FP8_1.0.0.2e",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors",
"versions": [
{
"status": "unaffected",
"version": "CezannePI-FP6 1.0.1.1b + OS Updates"
"version": "ShimadaPeakPI-SP6 1.0.0.1h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 400 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates"
"version": "GorgonPI-FP8_1.0.0.2e",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 4005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates"
"version": "EmbeddedAM5PI_1.0.0.9",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7000 Series Mobile Processors",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "DragonRangeFL1 1.0.0.3g + OS Updates"
"version": "EmbeddedTurinPI_SP5_1005",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ Embedded 7003 Series Processors",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 9000 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "EmbMilanPI-SP3 1.0.0.A + OS updates"
"version": "EmbeddedAM5PI_1.0.0.9",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ Embedded 8004 Series Processors",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded P100 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "EmbGenoaPI-SP5 1.0.0.9 + OS updates"
"version": "EmbeddedP100 PI 1000",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ Embedded 9004 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 2005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "EmbGenoaPI-SP5 1.0.0.9 + OS updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ Embedded 5000 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "EmbAM4PI 1.0.0.7 + OS Update"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ Embedded 7000 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "EmbeddedAM5PI 1.0.0.3 + OS updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ Embedded V3000 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "Embedded-PI_FP7r2 100C + OS updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ Embedded 97X4",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "EmbGenoaPI-SP5 1.0.0.9 + OS updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "CezannePI-FP6 1.0.1.1b + OS Updates"
"version": "EmbeddedFireRangeFL1_1.0.0.5",
"status": "unaffected"
}
]
}
],
"datePublic": "2025-07-08T16:00:00.000Z",
"datePublic": "2026-11-12T19:30:35.819Z",
"descriptions": [
{
"lang": "en",
"value": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.<br>"
}
],
"value": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
@@ -334,22 +240,42 @@
]
}
],
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2025-07-08T17:02:23.593Z"
},
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html"
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7073.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
},
"adp": [
{
data/2024/36xxx/CVE-2024-36357.json
+99 -173
View File
@@ -8,317 +8,223 @@
"assignerShortName": "AMD",
"dateReserved": "2024-05-23T19:44:50.001Z",
"datePublished": "2025-07-08T17:01:48.957Z",
"dateUpdated": "2025-11-04T21:08:40.807Z"
"dateUpdated": "2026-11-12T19:31:45.952Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:31:45.952Z"
},
"affected": [
{
"defaultStatus": "affected",
"product": "AMD EPYC™ 7003 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "MilanPI 1.0.0.G + OS Updates"
"version": "TurinPI_1.0.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ 9004 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ 8005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "GenoaPI 1.0.0.E + OS Updates"
"version": "TurinPI_1.0.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ 8004 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ 4005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "GenoaPI 1.0.0.E + OS Updates"
"version": "ComboAM5PI 1.3.0.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ 9V64H Processor",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000HX Series Processors",
"versions": [
{
"status": "unaffected",
"version": "MI300PI 1.0.0.7 + OS Updates"
"version": "FireRangeFL1 PI-1.0.0.0i",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 5000 Series Desktop Processors",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 300 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "ComboAM4v2PI 1.2.0.E + OS Updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "ComboAM4v2PI 1.2.0.E + OS Updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7000 Series Desktop Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "ComboAM5PI 1.2.0.3 + OS Updates"
"version": "StrixKrackanPI-FP8_1.1.0.0h",
"status": "unaffected"
},
{
"status": "unaffected",
"version": "ComboAM5PI 1.0.0.a+ OS Updates"
"version": "StrixKrackanPI-FP8_1.1.0.2g",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI 1.2.0.3l",
"status": "unaffected"
},
{
"status": "unaffected",
"version": "ComboAM5PI 1.1.0.3c+ OS Updates"
"version": "ComboAM5PI 1.3.0.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Max 400 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "ComboAM5PI 1.2.0.3 + OS Updates"
},
{
"status": "unaffected",
"version": "ComboAM5PI 1.1.0.3c+ OS Updates"
"version": "GorgonHaloPI-FP11_1.0.0.0a",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Max 300 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "StormPeakPI-SP6 1.1.0.0i + OS Updates"
},
{
"status": "unaffected",
"version": "StormPeakPI-SP6 1.0.0.1k + OS Updates"
"version": "StrixHalo PI-FP11_1.0.0.2d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ AI400 Series Desktop Processors",
"versions": [
{
"status": "unaffected",
"version": "RembrandtPI-FP7 1.0.0.Bb + OS Updates"
"version": "ComboAM5PI 1.3.0.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Z2 Extreme",
"versions": [
{
"status": "unaffected",
"version": "RembrandtPI-FP7 1.0.0.Bb + OS Updates"
"version": "GorgonPI-FP8_1.0.0.2e",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors",
"versions": [
{
"status": "unaffected",
"version": "CezannePI-FP6 1.0.1.1b + OS Updates"
"version": "ShimadaPeakPI-SP6 1.0.0.1h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 400 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates"
"version": "GorgonPI-FP8_1.0.0.2e",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates"
"version": "EmbeddedTurinPI_SP5_1005",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 7000 Series Mobile Processors",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 9000 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "DragonRangeFL1 1.0.0.3g + OS Updates"
"version": "EmbeddedAM5PI_1.0.0.9",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ Embedded 7003 Series Processors",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded P100 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "EmbMilanPI-SP3 1.0.0.A + OS updates"
"version": "EmbeddedP100 PI 1000",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ Embedded 8004 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 2005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "EmbGenoaPI-SP5 1.0.0.9 + OS updates"
"version": "EmbeddedFireRangeFL1_1.0.0.5",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ Embedded 9004 Series Processors",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 4005 Series Processors",
"versions": [
{
"status": "unaffected",
"version": "EmbGenoaPI-SP5 1.0.0.9 + OS updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ Embedded 5000 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "EmbAM4PI 1.0.0.7 + OS Update"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ Embedded 7000 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "EmbeddedAM5PI 1.0.0.3 + OS updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ Embedded V3000 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "Embedded-PI_FP7r2 100C + OS updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC™ Embedded 97X4",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "EmbGenoaPI-SP5 1.0.0.9 + OS updates"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "CezannePI-FP6 1.0.1.1b + OS Updates"
"version": "EmbeddedAM5PI_1.0.0.9",
"status": "unaffected"
}
]
}
],
"datePublic": "2025-07-08T16:00:00.000Z",
"datePublic": "2026-11-12T19:30:26.176Z",
"descriptions": [
{
"lang": "en",
"value": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.<br>"
}
],
"value": "A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
@@ -334,22 +240,42 @@
]
}
],
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2025-07-08T17:01:48.957Z"
},
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html"
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7073.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
},
"adp": [
{
data/2024/41xxx/CVE-2024-41786.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2024-07-22T12:03:08.192Z",
"datePublished": "2026-11-08T15:54:09.862Z",
"dateUpdated": "2026-11-08T15:54:09.862Z"
"dateUpdated": "2026-11-12T20:16:34.149Z"
},
"containers": {
"cna": {
@@ -110,6 +110,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:10:38.575581Z",
"id": "CVE-2024-41786",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:16:34.149Z"
}
}
]
}
}
data/2025/0xxx/CVE-2025-0043.json
+100
View File
@@ -0,0 +1,100 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-0043",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2024-11-21T16:18:11.169Z",
"datePublished": "2026-11-12T19:33:13.057Z",
"dateUpdated": "2026-11-12T19:33:13.057Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:33:13.057Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "Vivado Software",
"versions": [
{
"version": "2026.1",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:33:01.051Z",
"descriptions": [
{
"lang": "en",
"value": "Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8024.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7,
"baseSeverity": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2025/54xxx/CVE-2025-54501.json
+133
View File
@@ -0,0 +1,133 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-54501",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2025-07-23T15:01:50.731Z",
"datePublished": "2026-11-12T19:08:06.182Z",
"dateUpdated": "2026-11-12T19:08:06.182Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:08:06.182Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 7003 Series Processors",
"versions": [
{
"version": "MilanPI-SP3_1.0.0.K",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"version": "TurinPI_1.0.0.A",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 7003 Series Processors",
"versions": [
{
"version": "EmbMilanPI-SP3 1.0.0.E",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"version": "EmbeddedTurinPI_SP5_1004",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:07:53.975Z",
"descriptions": [
{
"lang": "en",
"value": "Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access controls potentially resulting in a loss of SEV-SNP guest memory integrity.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access controls potentially resulting in a loss of SEV-SNP guest memory integrity.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1191",
"description": "CWE-1191 On-Chip Debug and Test Interface With Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3054.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2025/54xxx/CVE-2025-54507.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-54507",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2025-07-23T15:01:50.733Z",
"datePublished": "2026-11-12T19:20:24.706Z",
"dateUpdated": "2026-11-12T19:20:24.706Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:20:24.706Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"version": "TurinPI_1.0.0.8",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"version": "EmbeddedTurinPI_SP5_1004",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:20:11.879Z",
"descriptions": [
{
"lang": "en",
"value": "Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1288",
"description": "CWE-1288 Improper Validation of Consistency within Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3058.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2026/0xxx/CVE-2026-0004.json
+309
View File
@@ -0,0 +1,309 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0004",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2025-10-09T19:57:44.246Z",
"datePublished": "2026-11-12T19:09:29.272Z",
"dateUpdated": "2026-11-12T19:09:29.272Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:09:29.272Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"version": "TurinPI_1.0.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 8005 Series Processors",
"versions": [
{
"version": "TurinPI_1.0.0.B",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000HX Series Processors",
"versions": [
{
"version": "FireRangeFL1 PI-1.0.0.0i",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 300 Series Processors",
"versions": [
{
"version": "StrixKrackanPI-FP8_1.1.0.0h",
"status": "unaffected"
},
{
"version": "StrixKrackanPI-FP8_1.1.0.2g",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ 9000 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI_1.2.0.3l",
"status": "unaffected"
},
{
"version": "ComboAM5PI_1.3.0.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Max 400 Series Processors",
"versions": [
{
"version": "GorgonHalo PI FP11_1.0.0.0b",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ AI Max 300 Series Processors",
"versions": [
{
"version": "StrixHalo PI-FP11_1.0.0.2d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 400 Series Desktop Processors",
"versions": [
{
"version": "ComboAM5PI_1.3.0.1d",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Z1 Series Processors",
"versions": [
{
"version": "StrixKrackanPI-FP8_1.1.0.0h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Z2 Series Processors Extreme",
"versions": [
{
"version": "StrixKrackanPI-FP8_1.1.0.0h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors",
"versions": [
{
"version": "ShimadaPeakPI-SP6-1.0.0.1h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ 7000 Processors",
"versions": [
{
"version": "ShimadaPeakPI-SP6-1.0.0.1h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ AI 400 Series Processors",
"versions": [
{
"version": "GorgonPI-FP8_1.0.0.2e",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ 9000 Processors",
"versions": [
{
"version": "ShimadaPeakPI-SP6-1.0.0.1h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors",
"versions": [
{
"version": "ShimadaPeakPI-SP6-1.0.0.1h",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"version": "EmbeddedTurinPI_SP5_1005",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 9000 Series Processors",
"versions": [
{
"version": "EmbeddedAM5PI_1.0.0.9",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 2005 Series Processors",
"versions": [
{
"version": "EmbeddedFireRangeFL1_1.0.0.5",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded P100 Series Processors",
"versions": [
{
"version": "EmbeddedP100 PI 1000",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:09:10.394Z",
"descriptions": [
{
"lang": "en",
"value": "A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute code on the system to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute code on the system to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1421",
"description": "CWE-1421 Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"
},
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3055.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2026/0xxx/CVE-2026-0101.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0101",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2025-10-16T20:45:17.320Z",
"datePublished": "2026-11-12T19:10:29.235Z",
"dateUpdated": "2026-11-12T19:10:29.235Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:10:29.235Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"version": "TurinPI_1.0.0.8",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"version": "EmbeddedTurinPI_SP5_1004",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:10:15.339Z",
"descriptions": [
{
"lang": "en",
"value": "Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass unsanitized input, potentially resulting in a system crash or denial of service.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass unsanitized input, potentially resulting in a system crash or denial of service.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3056.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2026/0xxx/CVE-2026-0436.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0436",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2025-12-06T13:53:50.288Z",
"datePublished": "2026-11-12T18:51:45.431Z",
"dateUpdated": "2026-11-12T18:56:05.903Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T18:56:05.903Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ 9005 Series Processors",
"versions": [
{
"version": "TurinPI_1.0.0.8",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD Instinct™ MI300C",
"versions": [
{
"version": "MI300C 1.0.0.3",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9005 Series Processors",
"versions": [
{
"version": "EmbeddedTurinPI_SP5_1004",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T18:55:47.946Z",
"descriptions": [
{
"lang": "en",
"value": "Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attacker to supply malicious input, potentially resulting in loss of platform integrity, memory leakage, or denial of service.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attacker to supply malicious input, potentially resulting in loss of platform integrity, memory leakage, or denial of service.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3053.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2026/0xxx/CVE-2026-0455.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0455",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2025-12-06T13:53:59.710Z",
"datePublished": "2026-11-12T19:34:35.382Z",
"dateUpdated": "2026-11-12T19:34:35.382Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:34:35.382Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "Versal™ AI Edge Series Gen 2 Adaptive SoCs",
"versions": [
{
"version": "2026.1",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "Versal™ Prime Series Gen 2 Adaptive SoCs (2VM3358, 2VM3558, and 2VM3858 only)",
"versions": [
{
"version": "2026.1",
"status": "unaffected"
}
]
},
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "VivadoTM Advanced Configuration Editor for Versal™ AI Edge Series Gen 2",
"versions": [
{
"version": "2026.1",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:34:23.108Z",
"descriptions": [
{
"lang": "en",
"value": "The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthorized access as expected. This allows processors in the SoC with any IPI channel access the ability to both read and write to the entire IPI buffer register space as well as the IPI no-buffer register control space.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthorized access as expected. This allows processors in the SoC with any IPI channel access the ability to both read and write to the entire IPI buffer register space as well as the IPI no-buffer register control space.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8027.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2026/0xxx/CVE-2026-0460.json
+100
View File
@@ -0,0 +1,100 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0460",
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"state": "PUBLISHED",
"assignerShortName": "AMD",
"dateReserved": "2025-12-06T13:54:02.506Z",
"datePublished": "2026-11-12T19:33:52.838Z",
"dateUpdated": "2026-11-12T19:33:52.838Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD",
"dateUpdated": "2026-11-12T19:33:52.838Z"
},
"affected": [
{
"defaultStatus": "affected",
"vendor": "AMD",
"product": "Bootgen",
"versions": [
{
"version": "2026.1",
"status": "unaffected"
}
]
}
],
"datePublic": "2026-11-12T19:33:42.639Z",
"descriptions": [
{
"lang": "en",
"value": "Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity.<br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8025.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
},
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"baseScore": 1,
"baseSeverity": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
]
}
}
}
data/2026/101xxx/CVE-2026-101604.json
+48 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "oracle",
"dateReserved": "2026-09-28T15:40:09.494Z",
"datePublished": "2026-10-20T21:21:50.141Z",
"dateUpdated": "2026-10-20T21:21:50.141Z"
"dateUpdated": "2026-11-12T19:00:23.634Z"
},
"containers": {
"cna": {
@@ -134,6 +134,52 @@
}
}
]
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-284",
"lang": "en",
"description": "CWE-284 Improper Access Control"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-05T15:56:57.016704Z",
"id": "CVE-2026-101604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:00:23.634Z"
}
}
]
}
}
data/2026/102xxx/CVE-2026-102618.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-09-29T14:27:29.053Z",
"datePublished": "2026-11-08T16:09:57.849Z",
"dateUpdated": "2026-11-08T16:09:57.849Z"
"dateUpdated": "2026-11-12T20:16:15.789Z"
},
"containers": {
"cna": {
@@ -120,6 +120,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:10:31.278004Z",
"id": "CVE-2026-102618",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:16:15.789Z"
}
}
]
}
}
data/2026/104xxx/CVE-2026-104619.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "suse",
"dateReserved": "2026-10-02T04:18:56.078Z",
"datePublished": "2026-11-10T09:27:53.111Z",
"dateUpdated": "2026-11-10T09:27:53.111Z"
"dateUpdated": "2026-11-12T17:44:23.451Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:44:11.486692Z",
"id": "CVE-2026-104619",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:44:23.451Z"
}
}
]
}
}
data/2026/106xxx/CVE-2026-106146.json
+113
View File
@@ -0,0 +1,113 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-106146",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-10-06T15:51:10.392Z",
"datePublished": "2026-11-12T17:18:48.039Z",
"dateUpdated": "2026-11-12T17:18:48.039Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-12T17:18:48.039Z"
},
"title": "Uncaught Exceptions in Telerik UI for ASP.NET MVC Filter Processing",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "Input Data Manipulation"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Telerik UI for ASP.NET MVC",
"versions": [
{
"status": "affected",
"version": "2012.2.710",
"lessThanOrEqual": "2026.3.1015",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`.</p>"
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-filter-processing-cve-2026-106146",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
}
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/106xxx/CVE-2026-106472.json
+170
View File
@@ -0,0 +1,170 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-106472",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-10-06T17:52:02.983Z",
"datePublished": "2026-11-12T17:40:38.018Z",
"dateUpdated": "2026-11-12T17:40:38.018Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.13",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.10",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.13",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.10",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Prometheus Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.1",
"versionType": "semver"
},
{
"lessThan": "13.2.6",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-12T17:40:38.018Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-106472"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Server-side request forgery in the Prometheus data source resource API"
}
}
}
data/2026/106xxx/CVE-2026-106475.json
+150
View File
@@ -0,0 +1,150 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-106475",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-10-06T17:52:05.181Z",
"datePublished": "2026-11-12T17:40:38.141Z",
"dateUpdated": "2026-11-12T17:40:38.141Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Elasticsearch Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.9.6",
"status": "affected",
"version": "12.4.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-12T17:40:38.141Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-106475"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials"
}
}
}
data/2026/107xxx/CVE-2026-107152.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107152",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-10-07T10:19:09.047Z",
"datePublished": "2026-11-12T20:04:09.664Z",
"dateUpdated": "2026-11-12T20:04:09.664Z"
},
"containers": {
"cna": {
"title": "Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed",
"metrics": [
{
"other": {
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rubygem-smart_proxy_dynflow",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-107152",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547374",
"name": "RHBZ#2547374",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-12T18:46:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-287: Improper Authentication",
"workarounds": [
{
"lang": "en",
"value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-07T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-12T18:46:00.000Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T20:04:09.664Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/107xxx/CVE-2026-107331.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-10-07T18:14:46.641Z",
"datePublished": "2026-11-08T16:52:46.226Z",
"dateUpdated": "2026-11-08T16:52:46.226Z"
"dateUpdated": "2026-11-12T20:13:42.873Z"
},
"containers": {
"cna": {
@@ -105,6 +105,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2026-107331",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-11-12T20:06:01.953926Z"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:13:42.873Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107360.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107360",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-10-07T20:07:22.060Z",
"datePublished": "2026-11-12T20:04:13.447Z",
"dateUpdated": "2026-11-12T20:04:13.447Z"
},
"containers": {
"cna": {
"title": "Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions",
"metrics": [
{
"other": {
"content": {
"value": "Critical",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rubygem-safemode",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-107360",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547645",
"name": "RHBZ#2547645",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-12T18:46:45.782Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-183",
"description": "Permissive List of Allowed Inputs",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-183: Permissive List of Allowed Inputs",
"workarounds": [
{
"lang": "en",
"value": "Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-12T18:46:45.782Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Kaya Emre Arikan for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T20:04:13.447Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/107xxx/CVE-2026-107365.json
+140
View File
@@ -0,0 +1,140 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107365",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-10-07T20:22:10.028Z",
"datePublished": "2026-11-12T17:40:38.119Z",
"dateUpdated": "2026-11-12T17:40:38.119Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "(built-in) Google Cloud Monitoring Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.6.7",
"status": "affected",
"version": "12.4.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.13",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.10",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "12.4.15",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.13",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.10",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-12T17:40:38.119Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-107365"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Unintended API access through the Google Cloud Monitoring data source resource proxy"
}
}
}
data/2026/107xxx/CVE-2026-107443.json
+130
View File
@@ -0,0 +1,130 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107443",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-10-08T02:33:13.616Z",
"datePublished": "2026-11-12T20:04:14.109Z",
"dateUpdated": "2026-11-12T20:04:14.109Z"
},
"containers": {
"cna": {
"title": "Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)",
"metrics": [
{
"other": {
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "foreman",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-107443",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-96659"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547760",
"name": "RHBZ#2547760",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-12T18:47:12.046Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-862: Missing Authorization",
"workarounds": [
{
"lang": "en",
"value": "Until a fix is deployed, remove view_hosts from untrusted users or block/restrict GET /api/v2/hosts/:id/template/:kind. Prefer granting only trusted administrators access that can view host provisioning output. Rotate host root credentials if Viewer-role users may have accessed this endpoint."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-12T18:47:12.046Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Sun Kimsroul for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T20:04:14.109Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/107xxx/CVE-2026-107776.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "WPScan",
"dateReserved": "2026-10-08T19:42:45.709Z",
"datePublished": "2026-11-05T07:35:21.025Z",
"dateUpdated": "2026-11-05T07:35:21.025Z"
"dateUpdated": "2026-11-12T18:59:51.239Z"
},
"containers": {
"cna": {
@@ -89,6 +89,40 @@
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-05T19:20:19.012253Z",
"id": "CVE-2026-107776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:59:51.239Z"
}
}
]
}
}
data/2026/108xxx/CVE-2026-108472.json
+60 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-09T22:24:14.527Z",
"datePublished": "2026-11-11T18:38:17.370Z",
"dateUpdated": "2026-11-12T16:52:56.950Z"
"dateUpdated": "2026-11-12T19:41:23.724Z"
},
"containers": {
"cna": {
@@ -48,6 +48,24 @@
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:6.16.0-2.el10_3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
@@ -67,16 +85,6 @@
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
@@ -139,6 +147,14 @@
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:99660",
"name": "RHSA-2026:99660",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99662",
"name": "RHSA-2026:99662",
@@ -204,7 +220,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:52:56.950Z"
"dateUpdated": "2026-11-12T17:19:10.679Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
@@ -223,6 +239,38 @@
"shortName": "CVE",
"dateUpdated": "2026-11-12T00:12:25.032Z"
}
},
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:41:15.961858Z",
"id": "CVE-2026-108472",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:41:23.724Z"
}
}
]
}
data/2026/108xxx/CVE-2026-108500.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-10T01:59:11.050Z",
"datePublished": "2026-11-04T10:37:55.532Z",
"dateUpdated": "2026-11-04T11:10:16.981Z"
"dateUpdated": "2026-11-12T19:13:25.426Z"
},
"containers": {
"cna": {
@@ -120,6 +120,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-04T11:10:16.981Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T12:35:16.564655Z",
"id": "CVE-2026-108500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:13:25.426Z"
}
}
]
}
data/2026/109xxx/CVE-2026-109683.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "TPLink",
"dateReserved": "2026-10-12T23:44:19.158Z",
"datePublished": "2026-11-06T19:26:40.010Z",
"dateUpdated": "2026-11-06T19:26:40.010Z"
"dateUpdated": "2026-11-12T18:59:22.479Z"
},
"containers": {
"cna": {
@@ -143,6 +143,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-06T20:07:08.142396Z",
"id": "CVE-2026-109683",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:59:22.479Z"
}
}
]
}
}
data/2026/10xxx/CVE-2026-10859.json
+2 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-06-04T13:24:14.044Z",
"datePublished": "2026-11-04T20:26:15.673Z",
"dateUpdated": "2026-11-11T11:30:19.455Z"
"dateUpdated": "2026-11-12T19:42:02.970Z"
},
"containers": {
"cna": {
@@ -164,7 +164,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T11:30:19.455Z"
"dateUpdated": "2026-11-12T19:42:02.970Z"
}
}
]
data/2026/111xxx/CVE-2026-111239.json
+2 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-15T18:35:58.969Z",
"datePublished": "2026-11-10T15:30:57.925Z",
"dateUpdated": "2026-11-11T10:51:11.015Z"
"dateUpdated": "2026-11-12T19:28:01.447Z"
},
"containers": {
"cna": {
@@ -209,7 +209,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T10:51:11.015Z"
"dateUpdated": "2026-11-12T19:28:01.447Z"
}
}
]
data/2026/111xxx/CVE-2026-111456.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-111456",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-10-16T04:40:13.923Z",
"datePublished": "2026-11-12T20:04:18.836Z",
"dateUpdated": "2026-11-12T20:04:18.836Z"
},
"containers": {
"cna": {
"title": "Candlepin: consumer certificate can register systems in another organization",
"metrics": [
{
"other": {
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization's key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization's subscription pools. When the organization is not using simple content access, the attacker can attach that organization's entitlements to the new consumer."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "candlepin",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-111456",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553939",
"name": "RHBZ#2553939",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-10-27T12:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key",
"workarounds": [
{
"lang": "en",
"value": "There is no configuration switch that stops a consumer certificate from calling registration while leaving normal consumer check-ins working. Restricting which clients can reach the Candlepin port limits who can attempt the call, and it does not stop a client that already has a valid consumer certificate and is allowed to use the API. Customers are advised to apply the relevant security updates when they become available."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-16T04:29:13.136Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-27T12:00:00.000Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Farid Narimanov for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T20:04:18.836Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/112xxx/CVE-2026-112314.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:23:32.344Z",
"datePublished": "2026-11-09T19:08:29.276Z",
"dateUpdated": "2026-11-12T12:58:32.022Z"
"dateUpdated": "2026-11-12T17:25:55.093Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112314",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:58:32.022Z"
"dateUpdated": "2026-11-12T17:25:55.093Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112315.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:23:58.679Z",
"datePublished": "2026-11-09T19:07:47.557Z",
"dateUpdated": "2026-11-12T16:47:25.081Z"
"dateUpdated": "2026-11-12T18:05:23.617Z"
},
"containers": {
"cna": {
@@ -214,6 +214,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:37:21.668280Z",
"id": "CVE-2026-112315",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:05:23.617Z"
}
}
]
}
}
data/2026/112xxx/CVE-2026-112320.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:26:51.377Z",
"datePublished": "2026-11-09T19:08:07.434Z",
"dateUpdated": "2026-11-12T16:47:49.479Z"
"dateUpdated": "2026-11-12T18:05:17.103Z"
},
"containers": {
"cna": {
@@ -214,6 +214,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:37:24.602764Z",
"id": "CVE-2026-112320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:05:17.103Z"
}
}
]
}
}
data/2026/112xxx/CVE-2026-112369.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-10-19T15:49:50.662Z",
"datePublished": "2026-11-08T16:57:33.479Z",
"dateUpdated": "2026-11-08T16:57:33.479Z"
"dateUpdated": "2026-11-12T20:15:57.671Z"
},
"containers": {
"cna": {
@@ -108,6 +108,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:09:04.898403Z",
"id": "CVE-2026-112369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:15:57.671Z"
}
}
]
}
}
data/2026/112xxx/CVE-2026-112672.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-19T17:05:24.040Z",
"datePublished": "2026-10-26T20:36:03.577Z",
"dateUpdated": "2026-10-26T20:36:03.577Z"
"dateUpdated": "2026-11-12T19:10:30.684Z"
},
"containers": {
"cna": {
@@ -70,6 +70,68 @@
"shortName": "apple",
"dateUpdated": "2026-10-26T20:36:03.577Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-290",
"lang": "en",
"description": "CWE-290 Authentication Bypass by Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-03T18:08:43.945698Z",
"id": "CVE-2026-112672",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:10:30.684Z"
}
}
]
}
}
data/2026/112xxx/CVE-2026-112803.json
+17 -5
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-10-19T18:16:14.867Z",
"datePublished": "2026-11-10T18:18:18.307Z",
"dateUpdated": "2026-11-12T15:43:28.438Z"
"dateUpdated": "2026-11-12T18:48:23.735Z"
},
"containers": {
"cna": {
@@ -383,13 +383,25 @@
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-284",
"lang": "en",
"description": "CWE-284 Improper Access Control"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T20:22:15.539860Z",
"id": "CVE-2026-112803",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
@@ -401,8 +413,8 @@
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-11-10T20:22:15.539860Z"
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
@@ -411,7 +423,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T20:29:59.151Z"
"dateUpdated": "2026-11-12T18:48:23.735Z"
}
}
]
data/2026/112xxx/CVE-2026-112809.json
+17 -5
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-10-19T18:16:14.867Z",
"datePublished": "2026-11-10T18:18:21.667Z",
"dateUpdated": "2026-11-12T15:43:31.880Z"
"dateUpdated": "2026-11-12T18:47:47.268Z"
},
"containers": {
"cna": {
@@ -102,13 +102,25 @@
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-284",
"lang": "en",
"description": "CWE-284 Improper Access Control"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T20:21:05.582137Z",
"id": "CVE-2026-112809",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
@@ -120,8 +132,8 @@
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-11-10T20:21:05.582137Z"
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
@@ -130,7 +142,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T20:29:57.829Z"
"dateUpdated": "2026-11-12T18:47:47.268Z"
}
}
]
data/2026/113xxx/CVE-2026-113573.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-20T11:12:04.769Z",
"datePublished": "2026-11-10T21:19:44.663Z",
"dateUpdated": "2026-11-10T21:19:44.663Z"
"dateUpdated": "2026-11-12T18:00:45.699Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:26:41.054619Z",
"id": "CVE-2026-113573",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:00:45.699Z"
}
}
]
}
}
data/2026/113xxx/CVE-2026-113574.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-20T11:12:04.769Z",
"datePublished": "2026-11-10T21:19:38.897Z",
"dateUpdated": "2026-11-10T21:19:38.897Z"
"dateUpdated": "2026-11-12T19:11:18.908Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:10:59.933657Z",
"id": "CVE-2026-113574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:11:18.908Z"
}
}
]
}
}
data/2026/113xxx/CVE-2026-113843.json
+17 -5
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-10-20T19:03:07.280Z",
"datePublished": "2026-11-10T18:19:05.116Z",
"dateUpdated": "2026-11-12T15:44:14.262Z"
"dateUpdated": "2026-11-12T19:30:00.142Z"
},
"containers": {
"cna": {
@@ -447,13 +447,25 @@
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-287",
"lang": "en",
"description": "CWE-287 Improper Authentication"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T20:07:31.541027Z",
"id": "CVE-2026-113843",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
@@ -465,8 +477,8 @@
"Technical Impact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-11-10T20:07:31.541027Z"
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
@@ -475,7 +487,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T20:09:32.128Z"
"dateUpdated": "2026-11-12T19:30:00.142Z"
}
}
]
data/2026/113xxx/CVE-2026-113960.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-20T21:06:55.480Z",
"datePublished": "2026-11-09T20:27:59.498Z",
"dateUpdated": "2026-11-09T20:27:59.498Z"
"dateUpdated": "2026-11-12T17:36:51.372Z"
},
"containers": {
"cna": {
@@ -124,6 +124,68 @@
"shortName": "apple",
"dateUpdated": "2026-11-09T20:27:59.498Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-284",
"lang": "en",
"description": "CWE-284 Improper Access Control"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:36:45.582113Z",
"id": "CVE-2026-113960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:36:51.372Z"
}
}
]
}
}
data/2026/113xxx/CVE-2026-113969.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-20T21:06:55.481Z",
"datePublished": "2026-11-09T20:28:00.897Z",
"dateUpdated": "2026-11-09T20:28:00.897Z"
"dateUpdated": "2026-11-12T17:37:57.566Z"
},
"containers": {
"cna": {
@@ -142,6 +142,68 @@
"shortName": "apple",
"dateUpdated": "2026-11-09T20:28:00.897Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-693",
"lang": "en",
"description": "CWE-693 Protection Mechanism Failure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:37:50.718860Z",
"id": "CVE-2026-113969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:37:57.566Z"
}
}
]
}
}
data/2026/114xxx/CVE-2026-114372.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-21T11:06:17.315Z",
"datePublished": "2026-11-10T21:56:37.557Z",
"dateUpdated": "2026-11-10T21:56:37.557Z"
"dateUpdated": "2026-11-12T18:00:19.537Z"
},
"containers": {
"cna": {
@@ -131,6 +131,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:26:46.560335Z",
"id": "CVE-2026-114372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:00:19.537Z"
}
}
]
}
}
data/2026/114xxx/CVE-2026-114543.json
+52 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "drupal",
"dateReserved": "2026-10-21T17:08:25.389Z",
"datePublished": "2026-10-30T03:09:29.665Z",
"dateUpdated": "2026-10-30T03:09:29.665Z"
"dateUpdated": "2026-11-12T19:10:46.588Z"
},
"containers": {
"cna": {
@@ -91,6 +91,56 @@
"shortName": "drupal",
"dateUpdated": "2026-10-30T03:09:29.665Z"
}
}
},
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-06T14:42:52.686537Z",
"id": "CVE-2026-114543",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:10:46.588Z"
}
}
]
}
}
data/2026/114xxx/CVE-2026-114690.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-21T22:14:31.928Z",
"datePublished": "2026-10-30T07:13:04.008Z",
"dateUpdated": "2026-11-11T19:13:07.221Z"
"dateUpdated": "2026-11-12T17:25:26.206Z"
},
"containers": {
"cna": {
@@ -122,6 +122,24 @@
"cpe:/o:redhat:enterprise_linux:8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:15.2.1-7.3.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -328,16 +346,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -796,6 +804,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99632",
"name": "RHSA-2026:99632",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-114690",
"tags": [
@@ -853,7 +869,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T19:13:07.221Z"
"dateUpdated": "2026-11-12T17:25:26.206Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/114xxx/CVE-2026-114691.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-21T22:16:10.067Z",
"datePublished": "2026-10-30T07:13:05.891Z",
"dateUpdated": "2026-11-11T19:13:07.528Z"
"dateUpdated": "2026-11-12T17:25:26.150Z"
},
"containers": {
"cna": {
@@ -122,6 +122,24 @@
"cpe:/o:redhat:enterprise_linux:8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:15.2.1-7.3.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -328,16 +346,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -796,6 +804,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99632",
"name": "RHSA-2026:99632",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-114691",
"tags": [
@@ -853,7 +869,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T19:13:07.528Z"
"dateUpdated": "2026-11-12T17:25:26.150Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/114xxx/CVE-2026-114713.json
+33 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mitre",
"dateReserved": "2026-10-22T00:56:41.381Z",
"datePublished": "2026-11-08T02:31:48.387Z",
"dateUpdated": "2026-11-08T11:04:43.329Z"
"dateUpdated": "2026-11-12T19:56:06.212Z"
},
"containers": {
"cna": {
@@ -158,6 +158,38 @@
"shortName": "CVE",
"dateUpdated": "2026-11-08T11:04:43.329Z"
}
},
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:55:27.812651Z",
"id": "CVE-2026-114713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:56:06.212Z"
}
}
]
}
data/2026/115xxx/CVE-2026-115455.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-22T15:06:48.490Z",
"datePublished": "2026-10-30T07:13:06.547Z",
"dateUpdated": "2026-11-11T19:13:07.953Z"
"dateUpdated": "2026-11-12T17:25:22.725Z"
},
"containers": {
"cna": {
@@ -102,6 +102,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:15.2.1-7.3.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -276,16 +294,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -416,6 +424,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99632",
"name": "RHSA-2026:99632",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-115455",
"tags": [
@@ -470,7 +486,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T19:13:07.953Z"
"dateUpdated": "2026-11-12T17:25:22.725Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/115xxx/CVE-2026-115456.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-22T15:06:48.490Z",
"datePublished": "2026-10-30T08:21:50.361Z",
"dateUpdated": "2026-11-11T19:24:21.584Z"
"dateUpdated": "2026-11-12T17:28:32.161Z"
},
"containers": {
"cna": {
@@ -102,6 +102,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:15.2.1-7.3.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -298,16 +316,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -758,6 +766,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99632",
"name": "RHSA-2026:99632",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-115456",
"tags": [
@@ -809,7 +825,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T19:24:21.584Z"
"dateUpdated": "2026-11-12T17:28:32.161Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/116xxx/CVE-2026-116337.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Qt",
"dateReserved": "2026-10-26T05:27:24.493Z",
"datePublished": "2026-11-09T08:58:30.529Z",
"dateUpdated": "2026-11-09T08:58:30.529Z"
"dateUpdated": "2026-11-12T18:59:08.117Z"
},
"containers": {
"cna": {
@@ -152,6 +152,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-09T15:12:22.055259Z",
"id": "CVE-2026-116337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:59:08.117Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116468.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-26T10:31:08.562Z",
"datePublished": "2026-11-11T07:57:21.958Z",
"dateUpdated": "2026-11-11T07:57:21.958Z"
"dateUpdated": "2026-11-12T19:33:33.603Z"
},
"containers": {
"cna": {
@@ -142,6 +142,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:33:19.013628Z",
"id": "CVE-2026-116468",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:33:33.603Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116472.json
+33 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "kubernetes",
"dateReserved": "2026-10-26T22:36:13.547Z",
"datePublished": "2026-11-05T18:13:29.564Z",
"dateUpdated": "2026-11-05T22:05:45.488Z"
"dateUpdated": "2026-11-12T18:59:36.855Z"
},
"containers": {
"cna": {
@@ -143,6 +143,38 @@
"shortName": "CVE",
"dateUpdated": "2026-11-05T22:05:45.488Z"
}
},
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-05T18:58:13.190887Z",
"id": "CVE-2026-116472",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:59:36.855Z"
}
}
]
}
data/2026/116xxx/CVE-2026-116500.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-10-26T12:59:16.329Z",
"datePublished": "2026-11-08T17:04:53.713Z",
"dateUpdated": "2026-11-08T17:04:53.713Z"
"dateUpdated": "2026-11-12T20:07:54.796Z"
},
"containers": {
"cna": {
@@ -128,6 +128,40 @@
"type": "finder"
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:03:20.577933Z",
"id": "CVE-2026-116500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:07:54.796Z"
}
}
]
}
}
data/2026/117xxx/CVE-2026-117127.json
+2 -2
View File
@@ -5,7 +5,7 @@
"cveId": "CVE-2026-117127",
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"dateUpdated": "2026-11-09T17:05:02.205Z",
"dateUpdated": "2026-11-12T19:42:16.069Z",
"dateReserved": "2026-10-27T00:00:00.000Z",
"datePublished": "2026-11-02T00:00:00.000Z"
},
@@ -118,7 +118,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-09T17:05:02.205Z"
"dateUpdated": "2026-11-12T19:42:16.069Z"
}
}
]
data/2026/117xxx/CVE-2026-117542.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-117542",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-10-27T10:50:13.424Z",
"datePublished": "2026-11-12T18:04:28.377Z",
"dateUpdated": "2026-11-12T18:04:28.377Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jDownloads extension for Joomla",
"vendor": "jdownloads.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-4.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Łukasz Rybak"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations."
}
],
"value": "Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-35",
"description": "CWE-35: Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T18:04:28.377Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.jdownloads.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/117xxx/CVE-2026-117543.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-117543",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-10-27T10:50:13.424Z",
"datePublished": "2026-11-12T17:57:33.299Z",
"dateUpdated": "2026-11-12T17:57:33.299Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jDownloads extension for Joomla",
"vendor": "jdownloads.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-4.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Łukasz Rybak"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise prohibited destinations and disclosure of their responses (SSRF)."
}
],
"value": "Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise prohibited destinations and disclosure of their responses (SSRF)."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T17:57:33.299Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.jdownloads.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/117xxx/CVE-2026-117544.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-117544",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-10-27T10:50:13.425Z",
"datePublished": "2026-11-12T18:07:41.250Z",
"dateUpdated": "2026-11-12T18:07:41.250Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jDownloads extension for Joomla",
"vendor": "jdownloads.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-4.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Łukasz Rybak"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download."
}
],
"value": "Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 (Authorization Bypass Through User-Controlled Key)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T18:07:41.250Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.jdownloads.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/117xxx/CVE-2026-117550.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-117550",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-10-27T11:12:25.699Z",
"datePublished": "2026-11-12T17:57:39.629Z",
"dateUpdated": "2026-11-12T17:57:39.629Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jDownloads extension for Joomla",
"vendor": "jdownloads.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-4.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Łukasz Rybak"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy."
}
],
"value": "Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy."
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T17:57:39.629Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.jdownloads.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/117xxx/CVE-2026-117551.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-117551",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-10-27T11:12:25.699Z",
"datePublished": "2026-11-12T17:58:35.141Z",
"dateUpdated": "2026-11-12T17:58:35.141Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jDownloads extension for Joomla",
"vendor": "jdownloads.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-4.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Fadilulah Ajeigbe"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution."
}
],
"value": "Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T17:58:35.141Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.jdownloads.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/118xxx/CVE-2026-118137.json
+17 -5
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-10-27T17:35:36.727Z",
"datePublished": "2026-11-10T18:20:17.799Z",
"dateUpdated": "2026-11-12T15:45:26.248Z"
"dateUpdated": "2026-11-12T19:32:26.809Z"
},
"containers": {
"cna": {
@@ -447,13 +447,25 @@
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-863",
"lang": "en",
"description": "CWE-863 Incorrect Authorization"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T19:47:50.285573Z",
"id": "CVE-2026-118137",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
@@ -465,8 +477,8 @@
"Technical Impact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-11-10T19:47:50.285573Z"
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
@@ -475,7 +487,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T19:49:03.343Z"
"dateUpdated": "2026-11-12T19:32:26.809Z"
}
}
]
data/2026/118xxx/CVE-2026-118197.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-27T19:04:20.954Z",
"datePublished": "2026-11-10T21:56:38.752Z",
"dateUpdated": "2026-11-10T21:56:38.752Z"
"dateUpdated": "2026-11-12T19:12:40.044Z"
},
"containers": {
"cna": {
@@ -131,6 +131,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:12:24.770761Z",
"id": "CVE-2026-118197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:12:40.044Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118208.json
+17 -5
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-10-27T19:10:04.455Z",
"datePublished": "2026-11-10T18:21:49.791Z",
"dateUpdated": "2026-11-12T15:46:50.613Z"
"dateUpdated": "2026-11-12T19:31:43.521Z"
},
"containers": {
"cna": {
@@ -101,13 +101,25 @@
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-284",
"lang": "en",
"description": "CWE-284 Improper Access Control"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T19:44:20.970413Z",
"id": "CVE-2026-118208",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
@@ -119,8 +131,8 @@
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-11-10T19:44:20.970413Z"
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
@@ -129,7 +141,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T19:48:59.790Z"
"dateUpdated": "2026-11-12T19:31:43.521Z"
}
}
]
data/2026/118xxx/CVE-2026-118462.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ENISA",
"dateReserved": "2026-10-28T08:46:25.411Z",
"datePublished": "2026-11-09T11:51:58.643Z",
"dateUpdated": "2026-11-09T11:51:58.643Z"
"dateUpdated": "2026-11-12T19:59:56.693Z"
},
"containers": {
"cna": {
@@ -223,6 +223,40 @@
"source": {
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:58:38.503243Z",
"id": "CVE-2026-118462",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:59:56.693Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118464.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ENISA",
"dateReserved": "2026-10-28T08:46:25.411Z",
"datePublished": "2026-11-09T11:52:32.717Z",
"dateUpdated": "2026-11-09T11:52:32.717Z"
"dateUpdated": "2026-11-12T20:02:12.666Z"
},
"containers": {
"cna": {
@@ -167,6 +167,40 @@
"source": {
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:01:53.703126Z",
"id": "CVE-2026-118464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:02:12.666Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118465.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ENISA",
"dateReserved": "2026-10-28T08:46:25.411Z",
"datePublished": "2026-11-09T11:53:06.273Z",
"dateUpdated": "2026-11-09T11:53:06.273Z"
"dateUpdated": "2026-11-12T20:03:05.488Z"
},
"containers": {
"cna": {
@@ -167,6 +167,40 @@
"source": {
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:02:53.587949Z",
"id": "CVE-2026-118465",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:03:05.488Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118467.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ENISA",
"dateReserved": "2026-10-28T08:46:25.411Z",
"datePublished": "2026-11-09T11:56:43.635Z",
"dateUpdated": "2026-11-09T11:56:43.635Z"
"dateUpdated": "2026-11-12T20:03:31.935Z"
},
"containers": {
"cna": {
@@ -223,6 +223,40 @@
"source": {
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:03:19.631340Z",
"id": "CVE-2026-118467",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:03:31.935Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118468.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ENISA",
"dateReserved": "2026-10-28T08:46:25.411Z",
"datePublished": "2026-11-09T11:58:12.438Z",
"dateUpdated": "2026-11-09T11:58:12.438Z"
"dateUpdated": "2026-11-12T20:03:55.960Z"
},
"containers": {
"cna": {
@@ -163,6 +163,40 @@
"source": {
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:03:46.041621Z",
"id": "CVE-2026-118468",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:03:55.960Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118481.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-28T11:11:00.478Z",
"datePublished": "2026-11-10T21:56:45.436Z",
"dateUpdated": "2026-11-10T21:56:45.436Z"
"dateUpdated": "2026-11-12T18:00:06.364Z"
},
"containers": {
"cna": {
@@ -95,6 +95,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:26:48.752788Z",
"id": "CVE-2026-118481",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:00:06.364Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118482.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-28T11:11:00.478Z",
"datePublished": "2026-11-10T21:56:46.783Z",
"dateUpdated": "2026-11-10T21:56:46.783Z"
"dateUpdated": "2026-11-12T19:13:08.480Z"
},
"containers": {
"cna": {
@@ -95,6 +95,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T19:12:53.338808Z",
"id": "CVE-2026-118482",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:13:08.480Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118494.json
+21 -21
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Joomla",
"dateReserved": "2026-10-28T11:58:55.650Z",
"datePublished": "2026-11-05T18:02:09.401Z",
"dateUpdated": "2026-11-12T11:12:57.005Z"
"dateUpdated": "2026-11-12T18:06:15.131Z"
},
"containers": {
"cna": {
@@ -46,28 +46,28 @@
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
@@ -93,7 +93,7 @@
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-05T18:53:31.034Z"
"dateUpdated": "2026-11-12T18:06:15.131Z"
},
"references": [
{
data/2026/118xxx/CVE-2026-118495.json
+156
View File
@@ -0,0 +1,156 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118495",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-10-28T11:58:55.650Z",
"datePublished": "2026-11-12T17:54:45.081Z",
"dateUpdated": "2026-11-12T20:05:35.354Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AcyMailing extension for Joomla and WordPress",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
"version": "6.0.0-11.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0rus3c / Ghent University VDP https://vdp.ugent.be"
},
{
"lang": "en",
"type": "finder",
"value": "K1nako / Ghent University VDP https://vdp.ugent.be"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email address can read that subscriber's record, including the per-subscriber secret key that authorises the subscription management links. Holding that key, the attacker can act as that subscriber on those endpoints, which includes triggering the GDPR data export and the GDPR account deletion where those options are enabled."
}
],
"value": "Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email address can read that subscriber's record, including the per-subscriber secret key that authorises the subscription management links. Holding that key, the attacker can act as that subscriber on those endpoints, which includes triggering the GDPR data export and the GDPR account deletion where those options are enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T20:05:35.354Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.acymailing.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T18:04:15.877866Z",
"id": "CVE-2026-118495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:03:30.525Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118790.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ENISA",
"dateReserved": "2026-10-28T19:53:57.995Z",
"datePublished": "2026-11-09T12:02:34.618Z",
"dateUpdated": "2026-11-09T12:02:34.618Z"
"dateUpdated": "2026-11-12T20:04:36.989Z"
},
"containers": {
"cna": {
@@ -124,6 +124,40 @@
"source": {
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:04:09.765333Z",
"id": "CVE-2026-118790",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:04:36.989Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118904.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-10-29T05:03:43.393Z",
"datePublished": "2026-11-08T19:48:22.159Z",
"dateUpdated": "2026-11-08T19:48:22.159Z"
"dateUpdated": "2026-11-12T20:13:29.585Z"
},
"containers": {
"cna": {
@@ -106,6 +106,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:08:17.129444Z",
"id": "CVE-2026-118904",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:13:29.585Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118952.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-29T07:57:28.659Z",
"datePublished": "2026-10-30T06:04:14.196Z",
"dateUpdated": "2026-10-30T06:04:14.196Z"
"dateUpdated": "2026-11-12T19:00:09.243Z"
},
"containers": {
"cna": {
@@ -123,6 +123,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-10-30T19:37:48.997920Z",
"id": "CVE-2026-118952",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T19:00:09.243Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119078.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-29T13:10:03.787Z",
"datePublished": "2026-11-09T20:11:12.230Z",
"dateUpdated": "2026-11-10T00:11:04.919Z"
"dateUpdated": "2026-11-12T17:34:57.782Z"
},
"containers": {
"cna": {
@@ -127,6 +127,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-10T00:11:04.919Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:34:39.759113Z",
"id": "CVE-2026-119078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:34:57.782Z"
}
}
]
}
data/2026/119xxx/CVE-2026-119275.json
+226
View File
@@ -0,0 +1,226 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-119275",
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"state": "PUBLISHED",
"assignerShortName": "Fluid Attacks",
"dateReserved": "2026-10-29T18:40:37.682Z",
"datePublished": "2026-11-12T17:29:31.633Z",
"dateUpdated": "2026-11-12T17:29:31.633Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks",
"dateUpdated": "2026-11-12T17:29:31.633Z"
},
"title": "Akaunting 3.3.0 - Stored XSS through imported invoice numbers",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"affected": [
{
"vendor": "Akaunting",
"product": "Akaunting",
"platforms": [
"Windows",
"MacOS",
"Linux"
],
"repo": "https://github.com/akaunting/akaunting",
"versions": [
{
"status": "affected",
"version": "3.3.0",
"versionType": "semver"
}
],
"defaultStatus": "affected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:akaunting:akaunting:3.3.0:*:windows:*:*:*:*:*"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:akaunting:akaunting:3.3.0:*:macos:*:*:*:*:*"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:akaunting:akaunting:3.3.0:*:linux:*:*:*:*:*"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recurring invoice, Akaunting raw-renders the stored child number in an anchor, causing attacker-controlled markup to execute in the victim's browser.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recurring invoice, Akaunting raw-renders the stored child number in an anchor, causing attacker-controlled markup to execute in the victim's browser."
}
]
}
],
"references": [
{
"url": "https://fluidattacks.com/advisories/soda",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/akaunting/akaunting",
"tags": [
"product"
]
},
{
"url": "https://github.com/akaunting/akaunting/blob/3.3.0/app/Imports/Sales/Invoices/Sheets/Invoices.php",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/documents/show/children.blade.php",
"tags": [
"technical-description"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N"
}
}
],
"workarounds": [
{
"lang": "en",
"value": "Restrict invoice imports to trusted administrators, inspect existing document numbers for markup, and avoid opening recurring invoices with children imported from untrusted workbooks.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Restrict invoice imports to trusted administrators, inspect existing document numbers for markup, and avoid opening recurring invoices with children imported from untrusted workbooks."
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Escape document_number in the recurring-child view, remove the raw translation sink, normalize or reject markup in invoice-number imports, and add import-to-recurring-child rendering regression tests.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Escape document_number in the recurring-child view, remove the raw translation sink, normalize or reject markup in invoice-number imports, and add import-to-recurring-child rendering regression tests."
}
]
}
],
"timeline": [
{
"time": "2026-10-27T21:00:00.000Z",
"lang": "en",
"value": "Vulnerability discovered"
},
{
"time": "2026-10-29T20:13:00.000Z",
"lang": "en",
"value": "Vendor contacted"
},
{
"time": "2026-11-12T17:28:00.000Z",
"lang": "en",
"value": "Public disclosure"
}
],
"credits": [
{
"lang": "en",
"value": "Fluid Attacks' AI SAST Scanner",
"type": "finder"
},
{
"lang": "en",
"value": "Miguel Gómez",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/119xxx/CVE-2026-119446.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-07T21:44:37.269Z",
"datePublished": "2026-11-10T10:44:15.336Z",
"dateUpdated": "2026-11-10T17:11:05.623Z"
"dateUpdated": "2026-11-12T17:48:56.966Z"
},
"containers": {
"cna": {
@@ -426,6 +426,48 @@
"value": "1. Starting a login. nh user login, like any client of this flow, calls POST /api/auth/cli_session, which needs no authentication. NervesHubWeb.API.UserController.cli_session/2 calls NervesHub.Accounts.generate_cli_session_token/1, which stores a waiting login in the CLI session cache under a random UUID token with a six-digit confirmation code, and responds with the token, the code, and the URL /auth/cli/<token>.\n\n2. Approving a login. GET /auth/cli/<token> requires a signed-in web user. NervesHubWeb.SessionController.cli/2 finds the login by the token from the URL, shows the code, and renders a form that posts back to /auth/cli/<token>. The form carries no code field. cli_confirm/2 passes the signed-in user and the token to NervesHub.Accounts.verify_cli_session_token/2, which creates an API token for that user with create_user_api_token/2 and stores it on the login. Nothing compares the confirmation code with anything.\n\n3. Collecting the token. GET /api/auth/cli_session/<token>, also unauthenticated, returns the stored API token once the login is confirmed. Whoever started the login holds the token from step 1 and can poll until it arrives. The token is an ordinary API token and stays valid until the user deletes it."
}
]
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-9vr9-463q-46qp",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:48:38.519155Z",
"id": "CVE-2026-119446",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:48:56.966Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119610.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-30T12:06:07.150Z",
"datePublished": "2026-11-09T13:00:52.306Z",
"dateUpdated": "2026-11-09T13:00:52.306Z"
"dateUpdated": "2026-11-12T20:06:08.243Z"
},
"containers": {
"cna": {
@@ -158,6 +158,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T20:05:41.519156Z",
"id": "CVE-2026-119610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:06:08.243Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119759.json
+3 -3
View File
@@ -8,20 +8,20 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-10-30T15:31:52.080Z",
"datePublished": "2026-11-09T20:29:24.226Z",
"dateUpdated": "2026-11-10T16:05:59.549Z"
"dateUpdated": "2026-11-12T17:36:26.685Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-09T20:29:24.226Z"
"dateUpdated": "2026-11-12T17:36:26.685Z"
},
"title": "TrailBase 0.28.2 < 0.35.10 IDOR via Record API File Column",
"descriptions": [
{
"lang": "en",
"value": "TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another user's or table's file id in a record they own to read the victim's file bytes through their own record, or trigger permanent deletion of the victim's file by deleting or nulling their own record, while also using a $like filter on the file column to brute-force recover stripped ids character by character."
"value": "TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference in std.FileUpload columns, where the Record API accepts attacker-supplied object-store file ids on insert and update without ownership validation. An authenticated attacker who can read a victim’s row can recover its stripped file id via a $like filter and then permanently delete or orphan the victim’s file by deleting or nulling a record they own."
}
],
"tags": [
data/2026/119xxx/CVE-2026-119832.json
+17 -5
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-10-30T16:34:55.750Z",
"datePublished": "2026-11-10T18:22:45.185Z",
"dateUpdated": "2026-11-12T15:47:50.146Z"
"dateUpdated": "2026-11-12T19:26:49.657Z"
},
"containers": {
"cna": {
@@ -383,13 +383,25 @@
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-284",
"lang": "en",
"description": "CWE-284 Improper Access Control"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T19:19:22.565437Z",
"id": "CVE-2026-119832",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
@@ -401,8 +413,8 @@
"Technical Impact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-11-10T19:19:22.565437Z"
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
@@ -411,7 +423,7 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T19:28:21.661Z"
"dateUpdated": "2026-11-12T19:26:49.657Z"
}
}
]
data/2026/120xxx/CVE-2026-120012.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "sap",
"dateReserved": "2026-10-30T18:03:06.793Z",
"datePublished": "2026-11-10T08:04:43.305Z",
"dateUpdated": "2026-11-10T08:04:43.305Z"
"dateUpdated": "2026-11-12T17:42:37.465Z"
},
"containers": {
"cna": {
@@ -95,6 +95,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:42:13.882042Z",
"id": "CVE-2026-120012",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:42:37.465Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120013.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "sap",
"dateReserved": "2026-10-30T18:03:06.793Z",
"datePublished": "2026-11-10T08:05:17.340Z",
"dateUpdated": "2026-11-10T08:20:41.214Z"
"dateUpdated": "2026-11-12T17:43:43.190Z"
},
"containers": {
"cna": {
@@ -95,6 +95,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:43:25.914828Z",
"id": "CVE-2026-120013",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:43:43.190Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120033.json
+168
View File
@@ -0,0 +1,168 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120033",
"assignerOrgId": "57a55968-44ac-464c-a794-6ba3baad09c4",
"state": "PUBLISHED",
"assignerShortName": "NetDEF",
"dateReserved": "2026-10-30T18:11:52.731Z",
"datePublished": "2026-11-12T18:07:42.693Z",
"dateUpdated": "2026-11-12T18:07:42.693Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"bgpd"
],
"product": "frrouting",
"programFiles": [
"bgpd/bgp_fsm.c"
],
"programRoutines": [
{
"name": "bgp_event_stop_with_notify"
}
],
"repo": "https://github.com/FRRouting/frr/",
"vendor": "frrouting",
"versions": [
{
"changes": [
{
"at": "57a7f3eb48837359d6e3ee5ebd4acea8f49320e5",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "4967bf6d729d7dd14dff7b672b2fd4afe78a0d86",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Srinivasan Koona Lokabiraman <srinivasan@nexthop.ai> (not reported as security issue)"
},
{
"lang": "en",
"type": "tool",
"value": "Anthropic OSS-scanner (re-report, ANT-2026-GSLEN9XB)"
}
],
"descriptions": [
{
"lang": "en",
"value": "In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up.\n\n\nA BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can cause one of the following:\n\n * If the neighbor announced Graceful Restart support: bgpd crashes shortly after the session is closed (after the neighbor's announced restart time plus one keepalive interval), taking down all BGP sessions on the router. The neighbor can repeat this each time bgpd restarts.\n * Otherwise: the session stays stuck in the Established state. The neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator runs \"clear bgp <neighbor>\".\n\nThe neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior.\n\n\nRequired configuration: no special configuration is needed. Any BGP neighbor with an established session can trigger the issue under default settings, for example:\n\n router bgp 65001\n neighbor 192.0.2.2 remote-as 65002\n\nGraceful Restart helper mode, which leads to the crash, is enabled by default. With default timers (keepalive 60s, hold time 180s), the session is closed about 6 minutes after the neighbor stops reading."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "AUTOMATIC",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/AU:N/R:A",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617 Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-372",
"description": "CWE-372 Incomplete Internal State Distinction: Send Hold Timer expiry tears down the connection outside the BGP FSM, leaving it in the Established state without a socket",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57a55968-44ac-464c-a794-6ba3baad09c4",
"shortName": "NetDEF",
"dateUpdated": "2026-11-12T18:07:42.693Z"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/FRRouting/frr/pull/23945/changes/57a7f3eb48837359d6e3ee5ebd4acea8f49320e5"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart",
"workarounds": [
{
"lang": "en",
"value": "No configuration workaround fully prevents the issue. Monitor bgpd logs for \"has not made any SendQ progress for 2 holdtimes\" and run \"clear bgp <neighbor>\" for the affected neighbor, which raises a real FSM event and recovers the peer (this does not prevent the abort when Graceful Restart was negotiated, if the restart timer fires first)."
}
],
"x_generator": {
"engine": "vim"
}
}
}
}
data/2026/120xxx/CVE-2026-120113.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-10-30T20:49:28.693Z",
"datePublished": "2026-11-08T17:12:01.863Z",
"dateUpdated": "2026-11-08T17:12:01.863Z"
"dateUpdated": "2026-11-12T20:13:42.715Z"
},
"containers": {
"cna": {
@@ -108,6 +108,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2026-120113",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-11-12T20:05:54.382682Z"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T20:13:42.715Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120286.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-04T17:15:01.545Z",
"datePublished": "2026-11-10T10:44:07.907Z",
"dateUpdated": "2026-11-11T19:35:12.088Z"
"dateUpdated": "2026-11-12T17:47:59.045Z"
},
"containers": {
"cna": {
@@ -417,6 +417,48 @@
"value": "The dashboard reads the member's role into current_scope when a page mounts, and each privileged event handler is expected to call authorized!/2 with the permission it needs, all of which resolve to the manage role in lib/nerves_hub_web/helpers/authorization.ex. These handlers never do:\n\nDevice settings tab (NervesHubWeb.Components.DevicePage.SettingsTab): hooked_event/3 for delete-certificate, and handle_progress/3 for the certificate upload, which should require device:update.\n\nDevice details tab (NervesHubWeb.Components.DevicePage.DetailsTab): hooked_event/3 for add-tag, remove-tag, save-location-changes and clear-manual-location-information (device:update), and remove-from-deployment-group (device:set-deployment-group).\n\nDeployment group page (NervesHubWeb.Live.DeploymentGroups.Show and NervesHubWeb.Components.DeploymentGroupPage.Summary): handle_event/3 for move-matched-devices-to-deployment-group and remove-unmatched-devices-from-deployment-group, and handle_progress/3 for the device_csv upload (device:set-deployment-group), plus generate-firmware-deltas, retry_delta and delete_delta (deployment_group:update).\n\nThe pages show every one of these controls to view members, so each change takes a click, and a client can send the events directly over the LiveView socket regardless."
}
]
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:47:40.502753Z",
"id": "CVE-2026-120286",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:47:59.045Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120295.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-06T09:58:06.998Z",
"datePublished": "2026-11-10T10:43:26.342Z",
"dateUpdated": "2026-11-11T19:34:34.547Z"
"dateUpdated": "2026-11-12T17:43:44.771Z"
},
"containers": {
"cna": {
@@ -370,6 +370,48 @@
"value": "1. Target selection. The bulk actions sidebar (NervesHubWeb.Components.BulkActionsSidebar) lists the products of every organization in current_scope.user.orgs. Choosing one sends target-product to NervesHubWeb.Live.Devices.Index, which requires device:update in the current organization and then calls NervesHub.Products.get_by_id/2. That query joins the product's organization to its org_users rows and filters on the user's id only, so any membership in the target organization satisfies it, including the view role.\n\n2. The move. move-devices-product passes the selected devices, or every device matching the current filter, to NervesHub.Devices.BulkActions.move_many/3, which calls Devices.move/3 for each one and rewrites its org_id and product_id. No check of the user's role in the target organization happens on this path, while the API's move in NervesHubWeb.API.DeviceController requires manage there.\n\n3. Effect. The moved device still authenticates with its own certificate. On its next connection it is matched against the target product's deployment groups by platform, architecture and tags, joins one, and is sent that group's firmware with a download URL."
}
]
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:43:24.355706Z",
"id": "CVE-2026-120295",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:43:44.771Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120466.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120466",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-11-02T13:30:27.837Z",
"datePublished": "2026-11-12T17:57:55.856Z",
"dateUpdated": "2026-11-12T17:57:55.856Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AcyMailing extension for Joomla and WordPress",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor / mySites.guru"
},
{
"lang": "en",
"type": "finder",
"value": "K1nako / Ghent University VDP https://vdp.ugent.be"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site."
}
],
"value": "Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site."
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.8,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorisation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T17:57:55.856Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.acymailing.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/120xxx/CVE-2026-120467.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120467",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-11-02T13:30:27.837Z",
"datePublished": "2026-11-12T18:03:37.539Z",
"dateUpdated": "2026-11-12T18:03:37.539Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AcyMailing extension for Joomla and WordPress",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor / mySites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site."
}
],
"value": "Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site."
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 (Authorization Bypass Through User-Controlled Key)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T18:03:37.539Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.acymailing.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/120xxx/CVE-2026-120468.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120468",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-11-02T13:30:27.837Z",
"datePublished": "2026-11-12T18:00:37.079Z",
"dateUpdated": "2026-11-12T18:00:37.079Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AcyMailing extension for Joomla",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor / mySites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected."
}
],
"value": "Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T18:00:37.079Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.acymailing.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/120xxx/CVE-2026-120469.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120469",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-11-02T13:30:27.837Z",
"datePublished": "2026-11-12T17:57:40.556Z",
"dateUpdated": "2026-11-12T17:57:40.556Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AcyMailing extension for Joomla and WordPress",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor / mySites.guru"
},
{
"lang": "en",
"type": "finder",
"value": "K1nako / Ghent University VDP https://vdp.ugent.be"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain."
}
],
"value": "Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain."
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T17:57:40.556Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.acymailing.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/120xxx/CVE-2026-120470.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120470",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-11-02T13:30:27.837Z",
"datePublished": "2026-11-12T17:58:04.919Z",
"dateUpdated": "2026-11-12T17:58:04.919Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AcyMailing extension for Joomla and WordPress",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor / mySites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience."
}
],
"value": "Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience."
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorisation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T17:58:04.919Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.acymailing.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/120xxx/CVE-2026-120471.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120471",
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"state": "PUBLISHED",
"assignerShortName": "Joomla",
"dateReserved": "2026-11-02T13:30:27.837Z",
"datePublished": "2026-11-12T17:58:31.455Z",
"dateUpdated": "2026-11-12T17:58:31.455Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AcyMailing extension for Joomla",
"vendor": "Datasolution",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor / mySites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected."
}
],
"value": "Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorisation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla",
"dateUpdated": "2026-11-12T17:58:31.455Z"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.acymailing.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
}
}
data/2026/120xxx/CVE-2026-120513.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-02T16:12:49.399Z",
"datePublished": "2026-11-10T06:47:01.101Z",
"dateUpdated": "2026-11-10T06:47:01.101Z"
"dateUpdated": "2026-11-12T18:03:49.945Z"
},
"containers": {
"cna": {
@@ -100,6 +100,40 @@
"value": "Disclosed"
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:37:41.741628Z",
"id": "CVE-2026-120513",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T18:03:49.945Z"
}
}
]
}
}
Loaded 100 of 475 files, more files were not shown because too many files have changed in this diff. Show more