diff --git a/data/2026/103xxx/CVE-2026-103038.json b/data/2026/103xxx/CVE-2026-103038.json index 10b0dac75b..0dfa4ca584 100644 --- a/data/2026/103xxx/CVE-2026-103038.json +++ b/data/2026/103xxx/CVE-2026-103038.json @@ -8,66 +8,28 @@ "assignerShortName": "Fluid Attacks", "dateReserved": "2026-09-29T21:35:56.544Z", "datePublished": "2026-10-19T16:13:35.444Z", - "dateUpdated": "2026-10-20T19:29:29.488Z" + "dateUpdated": "2026-11-11T21:34:36.705Z" }, "containers": { "cna": { - "affected": [ + "providerMetadata": { + "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", + "shortName": "Fluid Attacks", + "dateUpdated": "2026-11-11T21:34:36.705Z" + }, + "title": "PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host", + "problemTypes": [ { - "cpes": [ - "cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:*:*:*:android:*:*" - ], - "defaultStatus": "unaffected", - "platforms": [ - "Android" - ], - "product": "PingTools Network Utilities", - "vendor": "StreamSoft", - "versions": [ + "descriptions": [ { - "status": "affected", - "version": "4.64" + "lang": "en", + "cweId": "CWE-78", + "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", + "type": "CWE" } ] } ], - "cpeApplicability": [ - { - "nodes": [ - { - "cpeMatch": [ - { - "criteria": "cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:*:*:*:android:*:*", - "vulnerable": true - } - ], - "negate": false, - "operator": "OR" - } - ], - "operator": "OR" - } - ], - "credits": [ - { - "lang": "en", - "type": "finder", - "value": "Andrés Ramos" - } - ], - "descriptions": [ - { - "lang": "en", - "supportingMedia": [ - { - "base64": false, - "type": "text/html", - "value": "

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

" - } - ], - "value": "PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions." - } - ], "impacts": [ { "descriptions": [ @@ -78,90 +40,130 @@ ] } ], + "affected": [ + { + "vendor": "StreamSoft", + "product": "PingTools Network Utilities", + "platforms": [ + "Android" + ], + "versions": [ + { + "status": "affected", + "version": "4.64", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected", + "cpes": [ + "cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:*:*:*:android:*:*" + ] + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:android:*:*:*:*:*" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

" + } + ] + } + ], + "references": [ + { + "url": "https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory", + "tags": [ + "third-party-advisory", + "technical-description", + "mitigation" + ] + }, + { + "url": "https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools", + "tags": [ + "product" + ] + } + ], "metrics": [ { - "cvssV4_0": { - "Automatable": "NOT_DEFINED", - "Recovery": "NOT_DEFINED", - "Safety": "NOT_DEFINED", - "attackComplexity": "LOW", - "attackRequirements": "NONE", - "attackVector": "LOCAL", - "baseScore": 8.6, - "baseSeverity": "HIGH", - "privilegesRequired": "NONE", - "providerUrgency": "NOT_DEFINED", - "subAvailabilityImpact": "NONE", - "subConfidentialityImpact": "NONE", - "subIntegrityImpact": "NONE", - "userInteraction": "NONE", - "valueDensity": "NOT_DEFINED", - "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", - "version": "4.0", - "vulnAvailabilityImpact": "HIGH", - "vulnConfidentialityImpact": "HIGH", - "vulnIntegrityImpact": "HIGH", - "vulnerabilityResponseEffort": "NOT_DEFINED" - }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } - ] - } - ], - "problemTypes": [ - { - "descriptions": [ - { - "cweId": "CWE-78", - "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", - "lang": "en", - "type": "CWE" - } - ] - } - ], - "providerMetadata": { - "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", - "shortName": "Fluid Attacks", - "dateUpdated": "2026-10-19T21:18:59.554Z" - }, - "references": [ - { - "tags": [ - "third-party-advisory", - "technical-description", - "mitigation" ], - "url": "https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory" - }, - { - "tags": [ - "product" - ], - "url": "https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools" + "cvssV4_0": { + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 8.6, + "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } } ], "solutions": [ { "lang": "en", + "value": "Replace the sh -c execution path with a process API that accepts an argument list and preserves the validated Host as one argument. Validate Host as a supported DNS name or IPv4/IPv6 address in both the Watcher editor and backup-import path, reject shell syntax, whitespace and option-like input, add regression tests, backport the correction, and upgrade to the first fixed release when it becomes available. Until then, do not import untrusted Watcher backups and do not enter untrusted values in Watcher ICMP Host fields.", "supportingMedia": [ { - "base64": false, "type": "text/html", + "base64": false, "value": "

Replace the sh -c execution path with a process API that accepts an argument list and preserves the validated Host as one argument. Validate Host as a supported DNS name or IPv4/IPv6 address in both the Watcher editor and backup-import path, reject shell syntax, whitespace and option-like input, add regression tests, backport the correction, and upgrade to the first fixed release when it becomes available. Until then, do not import untrusted Watcher backups and do not enter untrusted values in Watcher ICMP Host fields.

" } - ], - "value": "Replace the sh -c execution path with a process API that accepts an argument list and preserves the validated Host as one argument. Validate Host as a supported DNS name or IPv4/IPv6 address in both the Watcher editor and backup-import path, reject shell syntax, whitespace and option-like input, add regression tests, backport the correction, and upgrade to the first fixed release when it becomes available. Until then, do not import untrusted Watcher backups and do not enter untrusted values in Watcher ICMP Host fields." + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Andrés Ramos", + "type": "finder" } ], "source": { "discovery": "UNKNOWN" }, - "title": "PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host", "x_generator": { "engine": "Vulnogram 0.2.0" } diff --git a/data/2026/107xxx/CVE-2026-107922.json b/data/2026/107xxx/CVE-2026-107922.json new file mode 100644 index 0000000000..1981698015 --- /dev/null +++ b/data/2026/107xxx/CVE-2026-107922.json @@ -0,0 +1,28 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-107922", + "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", + "state": "REJECTED", + "dateReserved": "2026-10-09T07:33:58.359Z", + "dateUpdated": "2026-11-11T22:18:59.410Z", + "dateRejected": "2026-11-11T22:18:59.410Z", + "assignerShortName": "GitLab" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", + "shortName": "GitLab", + "dateUpdated": "2026-11-11T22:18:59.410Z" + }, + "rejectedReasons": [ + { + "lang": "en", + "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority." + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/111xxx/CVE-2026-111521.json b/data/2026/111xxx/CVE-2026-111521.json new file mode 100644 index 0000000000..e9b5131fa3 --- /dev/null +++ b/data/2026/111xxx/CVE-2026-111521.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-111521", + "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "state": "PUBLISHED", + "assignerShortName": "dell", + "dateReserved": "2026-10-16T10:04:03.177Z", + "datePublished": "2026-11-11T21:57:00.847Z", + "dateUpdated": "2026-11-11T21:57:00.847Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", + "shortName": "dell", + "dateUpdated": "2026-11-11T21:57:00.847Z" + }, + "datePublic": "2026-11-10T21:55:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-367", + "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Dell", + "product": "Display and Peripheral Manager (DDPM Windows)", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "2.4.0.17", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution." + } + ] + } + ], + "references": [ + { + "url": "https://www.dell.com/support/kbdoc/en-us/000527625/dsa-2026-482-security-update-for-dell-display-and-peripheral-manager-ddpm-windows-for-a-time-of-check-time-of-use-toctou-vulnerability", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "LOCAL", + "attackComplexity": "HIGH", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 7, + "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Dell would like to thank Steffen Rogge for reporting this issue.", + "type": "finder" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/121xxx/CVE-2026-121526.json b/data/2026/121xxx/CVE-2026-121526.json new file mode 100644 index 0000000000..b7e4da6019 --- /dev/null +++ b/data/2026/121xxx/CVE-2026-121526.json @@ -0,0 +1,123 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-121526", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-03T14:32:06.815Z", + "datePublished": "2026-11-11T21:31:49.831Z", + "dateUpdated": "2026-11-11T21:31:49.831Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.5.0", + "lessThanOrEqual": "6.5.7", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:49.831Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-601", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 5.8, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-191", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-191" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/121xxx/CVE-2026-121527.json b/data/2026/121xxx/CVE-2026-121527.json new file mode 100644 index 0000000000..2eadbfbed5 --- /dev/null +++ b/data/2026/121xxx/CVE-2026-121527.json @@ -0,0 +1,128 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-121527", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-03T14:32:07.977Z", + "datePublished": "2026-11-11T21:31:52.231Z", + "dateUpdated": "2026-11-11T21:31:52.231Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiClientEMS", + "cpes": [ + "cpe:2.3:a:fortinet:forticlientems:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.14:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.15:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.4.3", + "lessThanOrEqual": "7.4.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.12", + "lessThanOrEqual": "7.2.15", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:52.231Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-250", + "description": "Escalation of privilege", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "LOCAL", + "availabilityImpact": "HIGH", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiClientEMS version 8.0.0 or above\nUpgrade to FortiClientEMS version 7.4.8 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-192", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-192" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/121xxx/CVE-2026-121528.json b/data/2026/121xxx/CVE-2026-121528.json new file mode 100644 index 0000000000..33dfd0199a --- /dev/null +++ b/data/2026/121xxx/CVE-2026-121528.json @@ -0,0 +1,178 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-121528", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-03T14:32:10.363Z", + "datePublished": "2026-11-11T21:31:53.978Z", + "dateUpdated": "2026-11-11T21:31:53.978Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiOS", + "cpes": [ + "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.4", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.9", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.19", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.4.0", + "lessThanOrEqual": "6.4.16", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:53.978Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-295", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.7, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.5 or above\nUpgrade to FortiOS version 7.4.10 or above\nUpgrade to FortiOS version 7.2.14 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-193", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-193" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126144.json b/data/2026/126xxx/CVE-2026-126144.json new file mode 100644 index 0000000000..cef3a886f8 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126144.json @@ -0,0 +1,233 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126144", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:17.179Z", + "datePublished": "2026-11-11T21:28:56.637Z", + "dateUpdated": "2026-11-11T21:28:56.637Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.4", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiRecorder", + "cpes": [ + "cpe:2.3:a:fortinet:fortirecorder:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.6", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiVoice", + "cpes": [ + "cpe:2.3:a:fortinet:fortivoice:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.5", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.8", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:28:56.637Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to upcoming FortiVoice version 8.0.2 or above\nUpgrade to upcoming FortiVoice version 7.4.3 or above\nUpgrade to upcoming FortiVoice version 7.2.6 or above\nUpgrade to upcoming FortiVoice version 7.0.9 or above\nUpgrade to upcoming FortiRecorder version 7.6.3 or above\nUpgrade to upcoming FortiRecorder version 7.2.13 or above\nUpgrade to upcoming FortiRecorder version 7.0.7 or above\nUpgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.5 or above\nUpgrade to FortiMail version 7.4.7 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-196", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-196" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126145.json b/data/2026/126xxx/CVE-2026-126145.json new file mode 100644 index 0000000000..f327255069 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126145.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126145", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:19.462Z", + "datePublished": "2026-11-11T21:28:54.772Z", + "dateUpdated": "2026-11-11T21:28:54.772Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:28:54.772Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-197", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-197" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126146.json b/data/2026/126xxx/CVE-2026-126146.json new file mode 100644 index 0000000000..781bd7c0a7 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126146.json @@ -0,0 +1,175 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126146", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:20.762Z", + "datePublished": "2026-11-11T21:28:58.040Z", + "dateUpdated": "2026-11-11T21:28:58.040Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.4", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiRecorder", + "cpes": [ + "cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "7.6.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.6", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:28:58.040Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to upcoming FortiRecorder version 7.6.3 or above\nUpgrade to upcoming FortiRecorder version 7.2.13 or above\nUpgrade to upcoming FortiRecorder version 7.0.7 or above\nUpgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.5 or above\nUpgrade to FortiMail version 7.4.7 or above\nUpgrade to upcoming FortiMail version 7.2.10 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-198", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-198" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126147.json b/data/2026/126xxx/CVE-2026-126147.json new file mode 100644 index 0000000000..a637d8bb34 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126147.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126147", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:22.660Z", + "datePublished": "2026-11-11T21:29:16.713Z", + "dateUpdated": "2026-11-11T21:29:16.713Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:16.713Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-22", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-199", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-199" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126148.json b/data/2026/126xxx/CVE-2026-126148.json new file mode 100644 index 0000000000..30561123c1 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126148.json @@ -0,0 +1,103 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126148", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:25.970Z", + "datePublished": "2026-11-11T21:28:59.138Z", + "dateUpdated": "2026-11-11T21:28:59.138Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:28:59.138Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-200", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-200" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126149.json b/data/2026/126xxx/CVE-2026-126149.json new file mode 100644 index 0000000000..1fe28fe4b4 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126149.json @@ -0,0 +1,150 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126149", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:29.069Z", + "datePublished": "2026-11-11T21:29:03.844Z", + "dateUpdated": "2026-11-11T21:29:03.844Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:03.844Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-190", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-201", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-201" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126150.json b/data/2026/126xxx/CVE-2026-126150.json new file mode 100644 index 0000000000..c69087538a --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126150.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126150", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:30.281Z", + "datePublished": "2026-11-11T21:29:00.809Z", + "dateUpdated": "2026-11-11T21:29:00.809Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.5", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:00.809Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-640", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.1 or above\nUpgrade to FortiMail version 7.6.6 or above\nUpgrade to FortiMail version 7.4.8 or above\nUpgrade to upcoming FortiMail version 7.2.10 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-202", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-202" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126151.json b/data/2026/126xxx/CVE-2026-126151.json new file mode 100644 index 0000000000..9041921c52 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126151.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126151", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:31.681Z", + "datePublished": "2026-11-11T21:29:14.136Z", + "dateUpdated": "2026-11-11T21:29:14.136Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:14.136Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-303", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-203", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-203" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126152.json b/data/2026/126xxx/CVE-2026-126152.json new file mode 100644 index 0000000000..b21e03e6c3 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126152.json @@ -0,0 +1,150 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126152", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:33.618Z", + "datePublished": "2026-11-11T21:29:14.754Z", + "dateUpdated": "2026-11-11T21:29:14.754Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:14.754Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-639", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 7.6, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-204", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-204" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126153.json b/data/2026/126xxx/CVE-2026-126153.json new file mode 100644 index 0000000000..1cadbbf5ad --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126153.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126153", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:35.280Z", + "datePublished": "2026-11-11T21:29:13.400Z", + "dateUpdated": "2026-11-11T21:29:13.400Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:13.400Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-22", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-205", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-205" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126154.json b/data/2026/126xxx/CVE-2026-126154.json new file mode 100644 index 0000000000..d37415fe18 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126154.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126154", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:37.002Z", + "datePublished": "2026-11-11T21:29:13.715Z", + "dateUpdated": "2026-11-11T21:29:13.715Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted HTTP request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:13.715Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-787", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-206", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-206" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126155.json b/data/2026/126xxx/CVE-2026-126155.json new file mode 100644 index 0000000000..cd282849f8 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126155.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126155", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:39.254Z", + "datePublished": "2026-11-11T21:29:10.341Z", + "dateUpdated": "2026-11-11T21:29:10.341Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:10.341Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-207", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-207" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126156.json b/data/2026/126xxx/CVE-2026-126156.json new file mode 100644 index 0000000000..797df281f7 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126156.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126156", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:40.696Z", + "datePublished": "2026-11-11T21:29:14.950Z", + "dateUpdated": "2026-11-11T21:29:14.950Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:14.950Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-639", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-208", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-208" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126157.json b/data/2026/126xxx/CVE-2026-126157.json new file mode 100644 index 0000000000..e1b981a9fa --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126157.json @@ -0,0 +1,150 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126157", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:42.195Z", + "datePublished": "2026-11-11T21:29:09.159Z", + "dateUpdated": "2026-11-11T21:29:09.159Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:09.159Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-287", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-209", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-209" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126158.json b/data/2026/126xxx/CVE-2026-126158.json new file mode 100644 index 0000000000..4d78a437d2 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126158.json @@ -0,0 +1,90 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126158", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:44.611Z", + "datePublished": "2026-11-11T21:29:12.696Z", + "dateUpdated": "2026-11-11T21:29:12.696Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:12.696Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-210", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-210" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126159.json b/data/2026/126xxx/CVE-2026-126159.json new file mode 100644 index 0000000000..5dccf29b29 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126159.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126159", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:46.218Z", + "datePublished": "2026-11-11T21:29:17.990Z", + "dateUpdated": "2026-11-11T21:29:17.990Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:17.990Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-639", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-211", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-211" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126160.json b/data/2026/126xxx/CVE-2026-126160.json new file mode 100644 index 0000000000..376873a67d --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126160.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126160", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:47.807Z", + "datePublished": "2026-11-11T21:29:19.376Z", + "dateUpdated": "2026-11-11T21:29:19.376Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:19.376Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-287", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-212", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-212" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126161.json b/data/2026/126xxx/CVE-2026-126161.json new file mode 100644 index 0000000000..ea6ea57e51 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126161.json @@ -0,0 +1,116 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126161", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:49.457Z", + "datePublished": "2026-11-11T21:29:23.614Z", + "dateUpdated": "2026-11-11T21:29:23.614Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.6", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:23.614Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-400", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-213", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-213" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126162.json b/data/2026/126xxx/CVE-2026-126162.json new file mode 100644 index 0000000000..7fd07d1840 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126162.json @@ -0,0 +1,103 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126162", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:50.954Z", + "datePublished": "2026-11-11T21:29:21.221Z", + "dateUpdated": "2026-11-11T21:29:21.221Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:21.221Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-91", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-214", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-214" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126163.json b/data/2026/126xxx/CVE-2026-126163.json new file mode 100644 index 0000000000..3cce323753 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126163.json @@ -0,0 +1,90 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126163", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:52.577Z", + "datePublished": "2026-11-11T21:29:25.391Z", + "dateUpdated": "2026-11-11T21:29:25.391Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:25.391Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-134", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-215", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-215" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126164.json b/data/2026/126xxx/CVE-2026-126164.json new file mode 100644 index 0000000000..0a0a33d05b --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126164.json @@ -0,0 +1,134 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126164", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:54.228Z", + "datePublished": "2026-11-11T21:29:26.070Z", + "dateUpdated": "2026-11-11T21:29:26.070Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:26.070Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 9.4, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-216", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-216" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126165.json b/data/2026/126xxx/CVE-2026-126165.json new file mode 100644 index 0000000000..689244ae3b --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126165.json @@ -0,0 +1,150 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126165", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:56.072Z", + "datePublished": "2026-11-11T21:29:24.082Z", + "dateUpdated": "2026-11-11T21:29:24.082Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted attachment delivered over SMTP." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:24.082Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-789", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-217", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-217" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126166.json b/data/2026/126xxx/CVE-2026-126166.json new file mode 100644 index 0000000000..bd80b03b21 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126166.json @@ -0,0 +1,135 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126166", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:57.660Z", + "datePublished": "2026-11-11T21:30:03.160Z", + "dateUpdated": "2026-11-11T21:30:03.160Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:03.160Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-88", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to upcoming FortiMail version 8.0.3 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126167.json b/data/2026/126xxx/CVE-2026-126167.json new file mode 100644 index 0000000000..bed99585e3 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126167.json @@ -0,0 +1,135 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126167", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:58.395Z", + "datePublished": "2026-11-11T21:29:59.621Z", + "dateUpdated": "2026-11-11T21:29:59.621Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:59.621Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-77", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to upcoming FortiMail version 8.0.3 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126168.json b/data/2026/126xxx/CVE-2026-126168.json new file mode 100644 index 0000000000..1a836ae208 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126168.json @@ -0,0 +1,135 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126168", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:03:59.395Z", + "datePublished": "2026-11-11T21:30:00.722Z", + "dateUpdated": "2026-11-11T21:30:00.722Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:00.722Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-88", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to upcoming FortiMail version 8.0.3 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126169.json b/data/2026/126xxx/CVE-2026-126169.json new file mode 100644 index 0000000000..34dfa886cb --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126169.json @@ -0,0 +1,135 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126169", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:04:00.242Z", + "datePublished": "2026-11-11T21:30:03.318Z", + "dateUpdated": "2026-11-11T21:30:03.318Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.6", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.8", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.9", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:03.318Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-88", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to upcoming FortiMail version 8.0.3 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126170.json b/data/2026/126xxx/CVE-2026-126170.json new file mode 100644 index 0000000000..882c50dbd0 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126170.json @@ -0,0 +1,217 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126170", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:04:05.712Z", + "datePublished": "2026-11-11T21:30:02.652Z", + "dateUpdated": "2026-11-11T21:30:02.652Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.1", + "lessThanOrEqual": "8.0.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.1", + "lessThanOrEqual": "8.0.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer-BigData", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.2", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:02.652Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-116", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to upcoming FortiManager version 8.0.3 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to upcoming FortiManager Cloud version 8.0.3 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to upcoming FortiAnalyzer-BigData version 7.6.3 or above\nUpgrade to FortiAnalyzer-BigData version 7.4.7 or above\nUpgrade to upcoming FortiAnalyzer-BigData version 7.2.13 or above\nUpgrade to upcoming FortiAnalyzer version 8.0.3 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to upcoming FortiAnalyzer Cloud version 8.0.3 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-219", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-219" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126171.json b/data/2026/126xxx/CVE-2026-126171.json new file mode 100644 index 0000000000..2042bbb0e0 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126171.json @@ -0,0 +1,425 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126171", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:04:12.449Z", + "datePublished": "2026-11-11T21:29:59.692Z", + "dateUpdated": "2026-11-11T21:29:59.692Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.16", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.16", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.1", + "lessThanOrEqual": "7.0.16", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.1", + "lessThanOrEqual": "7.0.16", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:59.692Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-134", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-220", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-220" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126175.json b/data/2026/126xxx/CVE-2026-126175.json new file mode 100644 index 0000000000..073e46ced0 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126175.json @@ -0,0 +1,305 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126175", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:02.441Z", + "datePublished": "2026-11-11T21:30:07.098Z", + "dateUpdated": "2026-11-11T21:30:07.098Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.2", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.2", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.2", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.2", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.2 through 7.2.13, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.2 through 7.2.12, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.2 through 7.2.13 may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:07.098Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.0 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.0 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.0 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.0 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-221", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-221" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126176.json b/data/2026/126xxx/CVE-2026-126176.json new file mode 100644 index 0000000000..1c6f4adaf4 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126176.json @@ -0,0 +1,329 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126176", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:08.231Z", + "datePublished": "2026-11-11T21:30:30.791Z", + "dateUpdated": "2026-11-11T21:30:30.791Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:30.791Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-91", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-222", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-222" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126177.json b/data/2026/126xxx/CVE-2026-126177.json new file mode 100644 index 0000000000..34502fa0d3 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126177.json @@ -0,0 +1,329 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126177", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:09.309Z", + "datePublished": "2026-11-11T21:30:30.450Z", + "dateUpdated": "2026-11-11T21:30:30.450Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:30.450Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-91", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-222", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-222" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126178.json b/data/2026/126xxx/CVE-2026-126178.json new file mode 100644 index 0000000000..36c4cb940d --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126178.json @@ -0,0 +1,341 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126178", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:19.657Z", + "datePublished": "2026-11-11T21:30:26.569Z", + "dateUpdated": "2026-11-11T21:30:26.569Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via a crafted request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:26.569Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-122", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-223", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-223" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126179.json b/data/2026/126xxx/CVE-2026-126179.json new file mode 100644 index 0000000000..e2292f0fde --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126179.json @@ -0,0 +1,329 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126179", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:25.114Z", + "datePublished": "2026-11-11T21:30:04.164Z", + "dateUpdated": "2026-11-11T21:30:04.164Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:04.164Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-224", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-224" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126180.json b/data/2026/126xxx/CVE-2026-126180.json new file mode 100644 index 0000000000..9e1c2a713b --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126180.json @@ -0,0 +1,209 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126180", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:28.711Z", + "datePublished": "2026-11-11T21:30:00.428Z", + "dateUpdated": "2026-11-11T21:30:00.428Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:00.428Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-1336", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.4, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-225", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-225" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126181.json b/data/2026/126xxx/CVE-2026-126181.json new file mode 100644 index 0000000000..f0526c5779 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126181.json @@ -0,0 +1,142 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126181", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:31.263Z", + "datePublished": "2026-11-11T21:29:57.274Z", + "dateUpdated": "2026-11-11T21:29:57.274Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:29:57.274Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-798", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "ADJACENT_NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-226", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-226" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126182.json b/data/2026/126xxx/CVE-2026-126182.json new file mode 100644 index 0000000000..dd204fa783 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126182.json @@ -0,0 +1,207 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126182", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:32.844Z", + "datePublished": "2026-11-11T21:30:30.930Z", + "dateUpdated": "2026-11-11T21:30:30.930Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:30.930Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-94", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-227", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-227" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126183.json b/data/2026/126xxx/CVE-2026-126183.json new file mode 100644 index 0000000000..c406dbc3e5 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126183.json @@ -0,0 +1,204 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126183", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:35.752Z", + "datePublished": "2026-11-11T21:30:33.338Z", + "dateUpdated": "2026-11-11T21:30:33.338Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the expected scope via specially crafted HTTP request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:33.338Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-639", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to upcoming FortiManager Cloud version 7.4.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-228", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-228" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126184.json b/data/2026/126xxx/CVE-2026-126184.json new file mode 100644 index 0000000000..4a3bb443f2 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126184.json @@ -0,0 +1,335 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126184", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:37.722Z", + "datePublished": "2026-11-11T21:30:34.611Z", + "dateUpdated": "2026-11-11T21:30:34.611Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an attacker to disrupt the HA state." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:34.611Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-290", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-229", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-229" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126185.json b/data/2026/126xxx/CVE-2026-126185.json new file mode 100644 index 0000000000..e8e8b5877f --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126185.json @@ -0,0 +1,267 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126185", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:44.597Z", + "datePublished": "2026-11-11T21:30:50.443Z", + "dateUpdated": "2026-11-11T21:30:50.443Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper control of generation of code ('code injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:50.443Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-94", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-230", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-230" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126211.json b/data/2026/126xxx/CVE-2026-126211.json new file mode 100644 index 0000000000..ca96ecc3e1 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126211.json @@ -0,0 +1,195 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126211", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:47.700Z", + "datePublished": "2026-11-11T21:31:07.366Z", + "dateUpdated": "2026-11-11T21:31:07.366Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.1", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.1", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.1", + "lessThanOrEqual": "7.6.8", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.1", + "lessThanOrEqual": "7.6.8", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper privilege management vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.1 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.1 through 7.6.8, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.1 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.1 through 7.6.8 may allow an authenticated privileged attacker to elevate their privileges via crafted JSON-RPC request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:07.366Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-269", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-231", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-231" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126212.json b/data/2026/126xxx/CVE-2026-126212.json new file mode 100644 index 0000000000..6af1bf7fad --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126212.json @@ -0,0 +1,267 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126212", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:53.626Z", + "datePublished": "2026-11-11T21:30:33.664Z", + "dateUpdated": "2026-11-11T21:30:33.664Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:33.664Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-122", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-232", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-232" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126213.json b/data/2026/126xxx/CVE-2026-126213.json new file mode 100644 index 0000000000..ff8c9aeb74 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126213.json @@ -0,0 +1,343 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126213", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:56.227Z", + "datePublished": "2026-11-11T21:31:03.916Z", + "dateUpdated": "2026-11-11T21:31:03.916Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:03.916Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-233", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-233" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126214.json b/data/2026/126xxx/CVE-2026-126214.json new file mode 100644 index 0000000000..f9a3df9ef6 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126214.json @@ -0,0 +1,272 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126214", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:07:59.845Z", + "datePublished": "2026-11-11T21:31:34.736Z", + "dateUpdated": "2026-11-11T21:31:34.736Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:34.736Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-290", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126215.json b/data/2026/126xxx/CVE-2026-126215.json new file mode 100644 index 0000000000..ee41a32304 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126215.json @@ -0,0 +1,341 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126215", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:00.992Z", + "datePublished": "2026-11-11T21:31:29.491Z", + "dateUpdated": "2026-11-11T21:31:29.491Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:29.491Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126216.json b/data/2026/126xxx/CVE-2026-126216.json new file mode 100644 index 0000000000..213327554c --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126216.json @@ -0,0 +1,204 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126216", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:02.270Z", + "datePublished": "2026-11-11T21:31:33.421Z", + "dateUpdated": "2026-11-11T21:31:33.421Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:33.421Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-269", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 3.8, + "baseSeverity": "LOW", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126217.json b/data/2026/126xxx/CVE-2026-126217.json new file mode 100644 index 0000000000..4e1ba89ec4 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126217.json @@ -0,0 +1,341 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126217", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:03.297Z", + "datePublished": "2026-11-11T21:31:29.318Z", + "dateUpdated": "2026-11-11T21:31:29.318Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:29.318Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 8.7, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126218.json b/data/2026/126xxx/CVE-2026-126218.json new file mode 100644 index 0000000000..25b172c795 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126218.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126218", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:19.441Z", + "datePublished": "2026-11-11T21:30:53.697Z", + "dateUpdated": "2026-11-11T21:30:53.697Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:53.697Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-639", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-235", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-235" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126219.json b/data/2026/126xxx/CVE-2026-126219.json new file mode 100644 index 0000000000..b300af9d79 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126219.json @@ -0,0 +1,255 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126219", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:20.846Z", + "datePublished": "2026-11-11T21:31:24.283Z", + "dateUpdated": "2026-11-11T21:31:24.283Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:24.283Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-22", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-236", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-236" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126220.json b/data/2026/126xxx/CVE-2026-126220.json new file mode 100644 index 0000000000..7fba2249e6 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126220.json @@ -0,0 +1,119 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126220", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:21.805Z", + "datePublished": "2026-11-11T21:31:24.528Z", + "dateUpdated": "2026-11-11T21:31:24.528Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:24.528Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-74", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-236", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-236" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126221.json b/data/2026/126xxx/CVE-2026-126221.json new file mode 100644 index 0000000000..f41ed739aa --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126221.json @@ -0,0 +1,255 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126221", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:22.541Z", + "datePublished": "2026-11-11T21:31:22.961Z", + "dateUpdated": "2026-11-11T21:31:22.961Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:22.961Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-74", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-236", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-236" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126222.json b/data/2026/126xxx/CVE-2026-126222.json new file mode 100644 index 0000000000..c4a6eb6fe6 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126222.json @@ -0,0 +1,185 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126222", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:29.336Z", + "datePublished": "2026-11-11T21:31:11.250Z", + "dateUpdated": "2026-11-11T21:31:11.250Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.3", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.3", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.3", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.3", + "lessThanOrEqual": "7.6.7", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.3 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.3 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.3 through 7.6.7 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:11.250Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-22", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-237", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-237" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126223.json b/data/2026/126xxx/CVE-2026-126223.json new file mode 100644 index 0000000000..017dbc935b --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126223.json @@ -0,0 +1,267 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126223", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:32.601Z", + "datePublished": "2026-11-11T21:30:34.728Z", + "dateUpdated": "2026-11-11T21:30:34.728Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:34.728Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-121", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-238", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-238" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126224.json b/data/2026/126xxx/CVE-2026-126224.json new file mode 100644 index 0000000000..c19bd4fa89 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126224.json @@ -0,0 +1,329 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126224", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:35.263Z", + "datePublished": "2026-11-11T21:31:33.631Z", + "dateUpdated": "2026-11-11T21:31:33.631Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged admin user to execute unauthorized code or commands." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:33.631Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-88", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-239", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-239" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126225.json b/data/2026/126xxx/CVE-2026-126225.json new file mode 100644 index 0000000000..16fb4719ce --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126225.json @@ -0,0 +1,161 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126225", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:41.327Z", + "datePublished": "2026-11-11T21:31:27.084Z", + "dateUpdated": "2026-11-11T21:31:27.084Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "version": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "version": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "version": "7.6.7", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "version": "7.6.7", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:27.084Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-862", + "description": "Escalation of privilege", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-240", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-240" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126226.json b/data/2026/126xxx/CVE-2026-126226.json new file mode 100644 index 0000000000..20a7af2773 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126226.json @@ -0,0 +1,329 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126226", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:44.782Z", + "datePublished": "2026-11-11T21:30:42.152Z", + "dateUpdated": "2026-11-11T21:30:42.152Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted report schedule name." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:42.152Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-241", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-241" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126227.json b/data/2026/126xxx/CVE-2026-126227.json new file mode 100644 index 0000000000..f069e7833f --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126227.json @@ -0,0 +1,335 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126227", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:51.693Z", + "datePublished": "2026-11-11T21:31:25.884Z", + "dateUpdated": "2026-11-11T21:31:25.884Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:25.884Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-441", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-242", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-242" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126228.json b/data/2026/126xxx/CVE-2026-126228.json new file mode 100644 index 0000000000..217c0abae2 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126228.json @@ -0,0 +1,327 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126228", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:08:56.054Z", + "datePublished": "2026-11-11T21:31:30.119Z", + "dateUpdated": "2026-11-11T21:31:30.119Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.4", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.4", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.4", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.4", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.4 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.4 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.4 through 7.2.12 may allow an authenticated remote attacker with admin privileges to execute unauthorized code or commands via a specially crafted request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:30.119Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-787", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-243", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-243" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126229.json b/data/2026/126xxx/CVE-2026-126229.json new file mode 100644 index 0000000000..4cf70d6d2c --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126229.json @@ -0,0 +1,429 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126229", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:01.512Z", + "datePublished": "2026-11-11T21:35:18.269Z", + "dateUpdated": "2026-11-11T21:35:18.269Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.16", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.16", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.13", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.1", + "lessThanOrEqual": "7.0.16", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.13", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.1", + "lessThanOrEqual": "7.0.16", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:35:18.269Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-639", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-244", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-244" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126230.json b/data/2026/126xxx/CVE-2026-126230.json new file mode 100644 index 0000000000..ebe29e00be --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126230.json @@ -0,0 +1,341 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126230", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:05.244Z", + "datePublished": "2026-11-11T21:30:40.873Z", + "dateUpdated": "2026-11-11T21:30:40.873Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:40.873Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-134", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-245", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-245" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126231.json b/data/2026/126xxx/CVE-2026-126231.json new file mode 100644 index 0000000000..63a8d96e94 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126231.json @@ -0,0 +1,323 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126231", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:08.839Z", + "datePublished": "2026-11-11T21:30:39.172Z", + "dateUpdated": "2026-11-11T21:30:39.172Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:39.172Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-246", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-246" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126232.json b/data/2026/126xxx/CVE-2026-126232.json new file mode 100644 index 0000000000..864ac380bf --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126232.json @@ -0,0 +1,339 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126232", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:13.512Z", + "datePublished": "2026-11-11T21:30:46.856Z", + "dateUpdated": "2026-11-11T21:30:46.856Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a MITM attacker to impersonate the radius server via a rogue RADIUS server." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:30:46.856Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-295", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "ADJACENT_NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-247", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-247" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126233.json b/data/2026/126xxx/CVE-2026-126233.json new file mode 100644 index 0000000000..a75cc2cd67 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126233.json @@ -0,0 +1,341 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126233", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:18.101Z", + "datePublished": "2026-11-11T21:31:21.093Z", + "dateUpdated": "2026-11-11T21:31:21.093Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to upload arbitrary files via specially crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:21.093Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-434", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:R" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-248", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-248" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126234.json b/data/2026/126xxx/CVE-2026-126234.json new file mode 100644 index 0000000000..afd54efea0 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126234.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126234", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:22.597Z", + "datePublished": "2026-11-11T21:31:21.596Z", + "dateUpdated": "2026-11-11T21:31:21.596Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:21.596Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-1336", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager Cloud version 8.0.1 or above\nUpgrade to FortiAnalyzer version 8.0.1 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.1 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-249", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-249" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126235.json b/data/2026/126xxx/CVE-2026-126235.json new file mode 100644 index 0000000000..22c3eeb26c --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126235.json @@ -0,0 +1,303 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126235", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:25.500Z", + "datePublished": "2026-11-11T21:31:23.876Z", + "dateUpdated": "2026-11-11T21:31:23.876Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.2", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.7", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.10", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.2", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.7", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.10", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.2 through 7.6.7, FortiManager 7.4.7 through 7.4.11, FortiManager 7.2.10 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to write arbitrary files via a specially crafted archive." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:23.876Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-22", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-250", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-250" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126236.json b/data/2026/126xxx/CVE-2026-126236.json new file mode 100644 index 0000000000..00fa15721b --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126236.json @@ -0,0 +1,335 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126236", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:28.825Z", + "datePublished": "2026-11-11T21:31:36.058Z", + "dateUpdated": "2026-11-11T21:31:36.058Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiAnalyzer Cloud", + "cpes": [ + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.1", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.1", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:36.058Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-251", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-251" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126237.json b/data/2026/126xxx/CVE-2026-126237.json new file mode 100644 index 0000000000..2c220256d8 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126237.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126237", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:35.016Z", + "datePublished": "2026-11-11T21:31:22.149Z", + "dateUpdated": "2026-11-11T21:31:22.149Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A loop with unreachable exit condition ('infinite loop') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to cause a denial of service via crafted TCP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:22.149Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-835", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-252", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-252" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126238.json b/data/2026/126xxx/CVE-2026-126238.json new file mode 100644 index 0000000000..e46cacac88 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126238.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126238", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:36.137Z", + "datePublished": "2026-11-11T21:31:27.516Z", + "dateUpdated": "2026-11-11T21:31:27.516Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:27.516Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 8.6, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-253", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-253" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126239.json b/data/2026/126xxx/CVE-2026-126239.json new file mode 100644 index 0000000000..2ea29ec468 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126239.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126239", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:37.231Z", + "datePublished": "2026-11-11T21:31:35.102Z", + "dateUpdated": "2026-11-11T21:31:35.102Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:35.102Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-121", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-254", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-254" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126240.json b/data/2026/126xxx/CVE-2026-126240.json new file mode 100644 index 0000000000..a30769f454 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126240.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126240", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:38.423Z", + "datePublished": "2026-11-11T21:31:29.472Z", + "dateUpdated": "2026-11-11T21:31:29.472Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username)." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:29.472Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-90", + "description": "Escalation of privilege", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-255", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-255" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126241.json b/data/2026/126xxx/CVE-2026-126241.json new file mode 100644 index 0000000000..2e2def1164 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126241.json @@ -0,0 +1,121 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126241", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:39.507Z", + "datePublished": "2026-11-11T21:31:35.181Z", + "dateUpdated": "2026-11-11T21:31:35.181Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.5.2", + "lessThanOrEqual": "6.5.7", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:35.181Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-256", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-256" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126242.json b/data/2026/126xxx/CVE-2026-126242.json new file mode 100644 index 0000000000..e1aeb5e6ad --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126242.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126242", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:40.669Z", + "datePublished": "2026-11-11T21:31:20.079Z", + "dateUpdated": "2026-11-11T21:31:20.079Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:20.079Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.4, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above\nUpgrade to upcoming FortiAuthenticator version 6.5.8 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-257", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-257" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126243.json b/data/2026/126xxx/CVE-2026-126243.json new file mode 100644 index 0000000000..97dd6009e3 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126243.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126243", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:41.253Z", + "datePublished": "2026-11-11T21:31:21.473Z", + "dateUpdated": "2026-11-11T21:31:21.473Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:21.473Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above\nUpgrade to upcoming FortiAuthenticator version 6.5.8 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-257", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-257" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126244.json b/data/2026/126xxx/CVE-2026-126244.json new file mode 100644 index 0000000000..af5e0ab8ff --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126244.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126244", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:42.853Z", + "datePublished": "2026-11-11T21:31:38.071Z", + "dateUpdated": "2026-11-11T21:31:38.071Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS)." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:38.071Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-770", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-258", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-258" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126245.json b/data/2026/126xxx/CVE-2026-126245.json new file mode 100644 index 0000000000..0e4bf34704 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126245.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126245", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:44.095Z", + "datePublished": "2026-11-11T21:31:40.840Z", + "dateUpdated": "2026-11-11T21:31:40.840Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:40.840Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-787", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-259", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-259" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126246.json b/data/2026/126xxx/CVE-2026-126246.json new file mode 100644 index 0000000000..5161e8f6d1 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126246.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126246", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:45.189Z", + "datePublished": "2026-11-11T21:31:42.366Z", + "dateUpdated": "2026-11-11T21:31:42.366Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A null pointer dereference vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform a denial of service attack via http requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:42.366Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-476", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-260", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-260" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126247.json b/data/2026/126xxx/CVE-2026-126247.json new file mode 100644 index 0000000000..153e6189ce --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126247.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126247", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:46.561Z", + "datePublished": "2026-11-11T21:31:41.907Z", + "dateUpdated": "2026-11-11T21:31:41.907Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:41.907Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-134", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-261", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-261" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126248.json b/data/2026/126xxx/CVE-2026-126248.json new file mode 100644 index 0000000000..bea077d8ba --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126248.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126248", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:47.977Z", + "datePublished": "2026-11-11T21:31:44.940Z", + "dateUpdated": "2026-11-11T21:31:44.940Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:44.940Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-522", + "description": "Information disclosure", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-262", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-262" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126249.json b/data/2026/126xxx/CVE-2026-126249.json new file mode 100644 index 0000000000..a4c3bda04d --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126249.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126249", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:49.476Z", + "datePublished": "2026-11-11T21:31:42.156Z", + "dateUpdated": "2026-11-11T21:31:42.156Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:42.156Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-269", + "description": "Escalation of privilege", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-263", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-263" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126250.json b/data/2026/126xxx/CVE-2026-126250.json new file mode 100644 index 0000000000..3a626e0bd7 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126250.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126250", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:50.790Z", + "datePublished": "2026-11-11T21:31:45.240Z", + "dateUpdated": "2026-11-11T21:31:45.240Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to cause a denial of service via HTTP requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:45.240Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-264", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-264" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126251.json b/data/2026/126xxx/CVE-2026-126251.json new file mode 100644 index 0000000000..f5ebdaf373 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126251.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126251", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:52.293Z", + "datePublished": "2026-11-11T21:31:45.917Z", + "dateUpdated": "2026-11-11T21:31:45.917Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:45.917Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "Escalation of privilege", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-265", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-265" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126252.json b/data/2026/126xxx/CVE-2026-126252.json new file mode 100644 index 0000000000..ea91bed077 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126252.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126252", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:53.760Z", + "datePublished": "2026-11-11T21:31:46.520Z", + "dateUpdated": "2026-11-11T21:31:46.520Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:46.520Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 8.3, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-266", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-266" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126253.json b/data/2026/126xxx/CVE-2026-126253.json new file mode 100644 index 0000000000..a14eeab75c --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126253.json @@ -0,0 +1,168 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126253", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:55.190Z", + "datePublished": "2026-11-11T21:31:47.633Z", + "dateUpdated": "2026-11-11T21:31:47.633Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiOS", + "cpes": [ + "cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.1", + "lessThanOrEqual": "7.0.19", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:47.633Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-305", + "description": "Improper access control", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "ADJACENT_NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.3, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiOS version 8.0.2 or above\nUpgrade to FortiOS version 7.6.8 or above\nUpgrade to FortiOS version 7.4.13 or above\nUpgrade to FortiOS version 7.2.14 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-267", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-267" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126254.json b/data/2026/126xxx/CVE-2026-126254.json new file mode 100644 index 0000000000..41dde36029 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126254.json @@ -0,0 +1,143 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126254", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:56.646Z", + "datePublished": "2026-11-11T21:31:50.608Z", + "dateUpdated": "2026-11-11T21:31:50.608Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiOS", + "cpes": [ + "cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request" + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:50.608Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-197", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.6, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H/E:F/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiOS version 8.0.2 or above\nUpgrade to FortiOS version 7.6.8 or above\nUpgrade to FortiOS version 7.4.13 or above\nUpgrade to FortiOS version 7.2.14 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-268", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-268" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126255.json b/data/2026/126xxx/CVE-2026-126255.json new file mode 100644 index 0000000000..5a5405d797 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126255.json @@ -0,0 +1,211 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126255", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:09:59.145Z", + "datePublished": "2026-11-11T21:31:52.405Z", + "dateUpdated": "2026-11-11T21:31:52.405Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiOS", + "cpes": [ + "cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiPAM", + "cpes": [ + "cpe:2.3:o:fortinet:fortipam:1.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.5.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.3.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "1.6.0", + "lessThanOrEqual": "1.6.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "1.5.0", + "lessThanOrEqual": "1.5.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "1.4.0", + "lessThanOrEqual": "1.4.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "1.3.0", + "lessThanOrEqual": "1.3.1", + "status": "affected" + }, + { + "version": "1.2.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "1.1.0", + "lessThanOrEqual": "1.1.2", + "status": "affected" + }, + { + "versionType": "semver", + "version": "1.0.0", + "lessThanOrEqual": "1.0.3", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:52.405Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-24", + "description": "Denial of service", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.4, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to upcoming FortiPAM version 7.0.1 or above\nUpgrade to FortiPAM version 1.9.3 or above\nUpgrade to upcoming FortiPAM version 1.8.5 or above\nUpgrade to upcoming FortiPAM version 1.7.3 or above\nUpgrade to FortiOS version 8.0.2 or above\nUpgrade to FortiOS version 7.6.8 or above\nUpgrade to FortiOS version 7.4.13 or above\nUpgrade to FortiOS version 7.2.14 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-269", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-269" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126256.json b/data/2026/126xxx/CVE-2026-126256.json new file mode 100644 index 0000000000..10bcc67dcb --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126256.json @@ -0,0 +1,171 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126256", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:10:03.791Z", + "datePublished": "2026-11-11T21:31:52.364Z", + "dateUpdated": "2026-11-11T21:31:52.364Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiOS", + "cpes": [ + "cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.14:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.13", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.14", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.19", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:52.364Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-125", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.4, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiOS version 8.0.2 or above\nUpgrade to FortiOS version 7.6.8 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-270", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-270" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126257.json b/data/2026/126xxx/CVE-2026-126257.json new file mode 100644 index 0000000000..ab50db73d5 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126257.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126257", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:10:07.651Z", + "datePublished": "2026-11-11T21:31:50.497Z", + "dateUpdated": "2026-11-11T21:31:50.497Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAuthenticator", + "cpes": [ + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.3", + "status": "affected" + }, + { + "versionType": "semver", + "version": "6.6.0", + "lessThanOrEqual": "6.6.10", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:50.497Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-259", + "description": "Escalation of privilege", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-271", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-271" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126258.json b/data/2026/126xxx/CVE-2026-126258.json new file mode 100644 index 0000000000..bd68e86cc2 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126258.json @@ -0,0 +1,92 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126258", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:10:09.146Z", + "datePublished": "2026-11-11T21:31:50.602Z", + "dateUpdated": "2026-11-11T21:31:50.602Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiOS", + "cpes": [ + "cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "version": "7.6.7", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:50.602Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-121", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiOS version 8.0.1 or above\nUpgrade to FortiOS version 7.6.8 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-272", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-272" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126259.json b/data/2026/126xxx/CVE-2026-126259.json new file mode 100644 index 0000000000..248b0baa06 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126259.json @@ -0,0 +1,166 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126259", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:10:11.024Z", + "datePublished": "2026-11-11T21:31:53.632Z", + "dateUpdated": "2026-11-11T21:31:53.632Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiOS", + "cpes": [ + "cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.12", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.13", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.0.0", + "lessThanOrEqual": "7.0.19", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:53.632Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-306", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiOS version 8.0.1 or above\nUpgrade to FortiOS version 7.6.8 or above\nUpgrade to FortiOS version 7.4.13 or above\nUpgrade to FortiOS version 7.2.14 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-273", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-273" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126262.json b/data/2026/126xxx/CVE-2026-126262.json new file mode 100644 index 0000000000..eaa0e948f3 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126262.json @@ -0,0 +1,206 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126262", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:10:16.521Z", + "datePublished": "2026-11-11T21:31:54.288Z", + "dateUpdated": "2026-11-11T21:31:54.288Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiAnalyzer", + "cpes": [ + "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + }, + { + "vendor": "Fortinet", + "product": "FortiManager", + "cpes": [ + "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", + "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "version": "8.0.0", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.7", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.11", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.2.0", + "lessThanOrEqual": "7.2.12", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:54.288Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "Execute unauthorized code or commands", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.3, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiManager version 8.0.1 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-276", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-276" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126263.json b/data/2026/126xxx/CVE-2026-126263.json new file mode 100644 index 0000000000..0a583fb366 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126263.json @@ -0,0 +1,114 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126263", + "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "state": "PUBLISHED", + "assignerShortName": "fortinet", + "dateReserved": "2026-11-10T20:10:19.532Z", + "datePublished": "2026-11-11T21:31:52.954Z", + "dateUpdated": "2026-11-11T21:31:52.954Z" + }, + "containers": { + "cna": { + "affected": [ + { + "vendor": "Fortinet", + "product": "FortiMail", + "cpes": [ + "cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*", + "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "versions": [ + { + "versionType": "semver", + "version": "8.0.0", + "lessThanOrEqual": "8.0.1", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.6.0", + "lessThanOrEqual": "7.6.4", + "status": "affected" + }, + { + "versionType": "semver", + "version": "7.4.0", + "lessThanOrEqual": "7.4.6", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests." + } + ], + "providerMetadata": { + "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", + "shortName": "fortinet", + "dateUpdated": "2026-11-11T21:31:52.954Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-89", + "description": "Escalation of privilege", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "cvssV3_1": { + "version": "3.1", + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.4, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.7 or above" + } + ], + "references": [ + { + "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-277", + "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-277" + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126326.json b/data/2026/126xxx/CVE-2026-126326.json new file mode 100644 index 0000000000..1e4171fb67 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126326.json @@ -0,0 +1,73 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126326", + "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "state": "PUBLISHED", + "assignerShortName": "DEVOLUTIONS", + "dateReserved": "2026-11-10T20:23:00.345Z", + "datePublished": "2026-11-11T21:25:53.824Z", + "dateUpdated": "2026-11-11T21:25:53.824Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "shortName": "DEVOLUTIONS", + "dateUpdated": "2026-11-11T21:25:53.824Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-284", + "description": "CWE-284 Improper Access Control", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Devolutions", + "product": "Server", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "2026.3.14", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request." + } + ] + } + ], + "references": [ + { + "url": "https://devolutions.net/security/advisories/DEVO-2026-0041/" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.2" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126327.json b/data/2026/126xxx/CVE-2026-126327.json new file mode 100644 index 0000000000..4838cdc655 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126327.json @@ -0,0 +1,73 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126327", + "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "state": "PUBLISHED", + "assignerShortName": "DEVOLUTIONS", + "dateReserved": "2026-11-10T20:26:37.533Z", + "datePublished": "2026-11-11T21:21:15.449Z", + "dateUpdated": "2026-11-11T21:21:15.449Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "shortName": "DEVOLUTIONS", + "dateUpdated": "2026-11-11T21:21:15.449Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-200", + "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Devolutions", + "product": "Server", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "2026.3.14", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API." + } + ] + } + ], + "references": [ + { + "url": "https://devolutions.net/security/advisories/DEVO-2026-0041/" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.2" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126328.json b/data/2026/126xxx/CVE-2026-126328.json new file mode 100644 index 0000000000..7dc07f69df --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126328.json @@ -0,0 +1,73 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126328", + "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "state": "PUBLISHED", + "assignerShortName": "DEVOLUTIONS", + "dateReserved": "2026-11-10T20:27:29.029Z", + "datePublished": "2026-11-11T21:23:00.048Z", + "dateUpdated": "2026-11-11T21:23:00.048Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "shortName": "DEVOLUTIONS", + "dateUpdated": "2026-11-11T21:23:00.048Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-312", + "description": "CWE-312 Cleartext Storage of Sensitive Information", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Devolutions", + "product": "Server", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "2026.3.14", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses." + } + ] + } + ], + "references": [ + { + "url": "https://devolutions.net/security/advisories/DEVO-2026-0041/" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.2" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126331.json b/data/2026/126xxx/CVE-2026-126331.json new file mode 100644 index 0000000000..4550ab5376 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126331.json @@ -0,0 +1,73 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126331", + "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "state": "PUBLISHED", + "assignerShortName": "DEVOLUTIONS", + "dateReserved": "2026-11-10T20:29:35.173Z", + "datePublished": "2026-11-11T21:24:17.153Z", + "dateUpdated": "2026-11-11T21:24:17.153Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "shortName": "DEVOLUTIONS", + "dateUpdated": "2026-11-11T21:24:17.153Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-201", + "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Devolutions", + "product": "Server", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "2026.3.14", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response." + } + ] + } + ], + "references": [ + { + "url": "https://devolutions.net/security/advisories/DEVO-2026-0041/" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.2" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126332.json b/data/2026/126xxx/CVE-2026-126332.json new file mode 100644 index 0000000000..3d9465e0be --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126332.json @@ -0,0 +1,73 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126332", + "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "state": "PUBLISHED", + "assignerShortName": "DEVOLUTIONS", + "dateReserved": "2026-11-10T20:30:30.530Z", + "datePublished": "2026-11-11T21:27:17.764Z", + "dateUpdated": "2026-11-11T21:27:17.764Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", + "shortName": "DEVOLUTIONS", + "dateUpdated": "2026-11-11T21:27:17.764Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-284", + "description": "CWE-284 Improper Access Control", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "Devolutions", + "product": "Server", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "2026.3.14", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault." + } + ] + } + ], + "references": [ + { + "url": "https://devolutions.net/security/advisories/DEVO-2026-0041/" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.2" + } + } + } +} \ No newline at end of file diff --git a/data/2026/65xxx/CVE-2026-65971.json b/data/2026/65xxx/CVE-2026-65971.json new file mode 100644 index 0000000000..5eb4c57463 --- /dev/null +++ b/data/2026/65xxx/CVE-2026-65971.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-65971", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-23T18:15:14.580Z", + "datePublished": "2026-11-11T21:49:12.607Z", + "dateUpdated": "2026-11-11T21:49:12.607Z" + }, + "containers": { + "cna": { + "title": "Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-89", + "lang": "en", + "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 7.6, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698r", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698r" + }, + { + "name": "https://github.com/Power-Components/livewire-powergrid/commit/13d047bf1637e82926e6914aa3ca0f29a4c9704a", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/Power-Components/livewire-powergrid/commit/13d047bf1637e82926e6914aa3ca0f29a4c9704a" + }, + { + "name": "https://github.com/Power-Components/livewire-powergrid/releases/tag/v6.10.4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/Power-Components/livewire-powergrid/releases/tag/v6.10.4" + } + ], + "affected": [ + { + "vendor": "Power-Components", + "product": "livewire-powergrid", + "versions": [ + { + "version": ">= 6.0.0, < 6.10.4", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:49:12.607Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4." + } + ], + "source": { + "advisory": "GHSA-7fgc-3h6c-698r", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67449.json b/data/2026/67xxx/CVE-2026-67449.json new file mode 100644 index 0000000000..3f618f719c --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67449.json @@ -0,0 +1,115 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67449", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T15:07:24.992Z", + "datePublished": "2026-11-11T21:51:23.105Z", + "dateUpdated": "2026-11-11T21:51:23.105Z" + }, + "containers": { + "cna": { + "title": "Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-22", + "lang": "en", + "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-306", + "lang": "en", + "description": "CWE-306: Missing Authentication for Critical Functionality", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/Portabase/portabase/security/advisories/GHSA-7697-vf3j-253j", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/Portabase/portabase/security/advisories/GHSA-7697-vf3j-253j" + }, + { + "name": "https://github.com/Portabase/portabase/pull/355", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/Portabase/portabase/pull/355" + }, + { + "name": "https://github.com/Portabase/portabase/commit/8dcb406790728fbdbf758ec88bf000af79498fc1", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/Portabase/portabase/commit/8dcb406790728fbdbf758ec88bf000af79498fc1" + }, + { + "name": "https://github.com/Portabase/portabase/releases/tag/1.21.2", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/Portabase/portabase/releases/tag/1.21.2" + } + ], + "affected": [ + { + "vendor": "Portabase", + "product": "portabase", + "versions": [ + { + "version": "< 1.21.2", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:51:23.105Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/master_key.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2." + } + ], + "source": { + "advisory": "GHSA-7697-vf3j-253j", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67540.json b/data/2026/67xxx/CVE-2026-67540.json new file mode 100644 index 0000000000..f2dea8b695 --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67540.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67540", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.074Z", + "datePublished": "2026-11-11T21:38:28.344Z", + "dateUpdated": "2026-11-11T21:38:28.344Z" + }, + "containers": { + "cna": { + "title": "Heym - Horizontal IDOR: get-by-id on workflow/node templates skips the visibility check the list path enforces", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-639", + "lang": "en", + "description": "CWE-639: Authorization Bypass Through User-Controlled Key", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/heymrun/heym/security/advisories/GHSA-5748-x76g-v68m", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/heymrun/heym/security/advisories/GHSA-5748-x76g-v68m" + }, + { + "name": "https://github.com/heymrun/heym/commit/4bcea469bfeee8c2659de90a1b2d16fdfed9ae97", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/4bcea469bfeee8c2659de90a1b2d16fdfed9ae97" + }, + { + "name": "https://github.com/heymrun/heym/releases/tag/0.0.70", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/releases/tag/0.0.70" + } + ], + "affected": [ + { + "vendor": "heymrun", + "product": "heym", + "versions": [ + { + "version": "< 0.0.70", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:38:28.344Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, get_workflow_template / get_node_template fetches a template by ID with no visibility / author / shared_with predicate, so any authenticated user can read (and use) any other tenant's private (visibility=specific_users) template — including its full node/edge graph and the email addresses it was shared with. The list endpoint enforces visibility correctly; the single-item get/use paths do not. This issue has been patched in version 0.0.70." + } + ], + "source": { + "advisory": "GHSA-5748-x76g-v68m", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67541.json b/data/2026/67xxx/CVE-2026-67541.json new file mode 100644 index 0000000000..d6799413bb --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67541.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67541", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.074Z", + "datePublished": "2026-11-11T21:39:02.673Z", + "dateUpdated": "2026-11-11T21:39:02.673Z" + }, + "containers": { + "cna": { + "title": "Heym: Missing role gate in team-member management lets any member add/remove members, exposing team-shared credentials", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-266", + "lang": "en", + "description": "CWE-266: Incorrect Privilege Assignment", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-862", + "lang": "en", + "description": "CWE-862: Missing Authorization", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/heymrun/heym/security/advisories/GHSA-vxpw-x7j7-8723", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/heymrun/heym/security/advisories/GHSA-vxpw-x7j7-8723" + }, + { + "name": "https://github.com/heymrun/heym/commit/863e2702fca9a584246da9a51cca6b12828cebcf", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/863e2702fca9a584246da9a51cca6b12828cebcf" + }, + { + "name": "https://github.com/heymrun/heym/commit/a9fc3d864e87fa2449b235798189db9cd39367c4", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/a9fc3d864e87fa2449b235798189db9cd39367c4" + }, + { + "name": "https://github.com/heymrun/heym/commit/def26b5cf77dad4a9c5b5ff11c9863a0bc144ac8", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/def26b5cf77dad4a9c5b5ff11c9863a0bc144ac8" + }, + { + "name": "https://github.com/heymrun/heym/releases/tag/0.0.70", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/releases/tag/0.0.70" + } + ], + "affected": [ + { + "vendor": "heymrun", + "product": "heym", + "versions": [ + { + "version": "< 0.0.70", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:39:02.673Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.user_id, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70." + } + ], + "source": { + "advisory": "GHSA-vxpw-x7j7-8723", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67542.json b/data/2026/67xxx/CVE-2026-67542.json new file mode 100644 index 0000000000..61bc82eab2 --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67542.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67542", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.074Z", + "datePublished": "2026-11-11T21:39:24.809Z", + "dateUpdated": "2026-11-11T21:39:24.809Z" + }, + "containers": { + "cna": { + "title": "Heym: SSRF via POST /api/mcp/fetch-tools: any authenticated user reaches local/private URLs through the SSE and streamable-HTTP transports", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-918", + "lang": "en", + "description": "CWE-918: Server-Side Request Forgery", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/heymrun/heym/security/advisories/GHSA-jjvx-3wfc-p8hq", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/heymrun/heym/security/advisories/GHSA-jjvx-3wfc-p8hq" + }, + { + "name": "https://github.com/heymrun/heym/commit/72954f1f6264f6260bc1148b09ca10d613992b64", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/72954f1f6264f6260bc1148b09ca10d613992b64" + }, + { + "name": "https://github.com/heymrun/heym/releases/tag/0.0.70", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/releases/tag/0.0.70" + } + ], + "affected": [ + { + "vendor": "heymrun", + "product": "heym", + "versions": [ + { + "version": "< 0.0.70", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:39:24.809Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, POST /api/mcp/fetch-tools is reachable by any authenticated user (lowest role; no admin/workflow association) and fetches an attacker-supplied URL through the sse and streamable_http transports with no scheme / private-IP / allowlist / redirect guard. The transport error is reflected in the HTTP 422 response, giving a semi-blind SSRF oracle, and the attacker also controls the outbound request headers. This issue has been patched in version 0.0.70." + } + ], + "source": { + "advisory": "GHSA-jjvx-3wfc-p8hq", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67543.json b/data/2026/67xxx/CVE-2026-67543.json new file mode 100644 index 0000000000..e796f95788 --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67543.json @@ -0,0 +1,115 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67543", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.074Z", + "datePublished": "2026-11-11T21:39:53.192Z", + "dateUpdated": "2026-11-11T21:39:53.192Z" + }, + "containers": { + "cna": { + "title": "Heym Unsandboxed skill code execution: skills run via a local backend subprocess without the Docker isolation that Python tools mandate", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-94", + "lang": "en", + "description": "CWE-94: Improper Control of Generation of Code", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-269", + "lang": "en", + "description": "CWE-269: Improper Privilege Management", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/heymrun/heym/security/advisories/GHSA-hcv7-mg77-pg73", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/heymrun/heym/security/advisories/GHSA-hcv7-mg77-pg73" + }, + { + "name": "https://github.com/heymrun/heym/commit/2155057f4153a1e3a7b789d104f7fa96e92964e5", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/2155057f4153a1e3a7b789d104f7fa96e92964e5" + }, + { + "name": "https://github.com/heymrun/heym/commit/28bb2901e4dea128ac493f67ee9478d230b7a3d7", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/28bb2901e4dea128ac493f67ee9478d230b7a3d7" + }, + { + "name": "https://github.com/heymrun/heym/releases/tag/0.0.70", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/releases/tag/0.0.70" + } + ], + "affected": [ + { + "vendor": "heymrun", + "product": "heym", + "versions": [ + { + "version": "< 0.0.70", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:39:53.192Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor (python_tool_executor.py) treats user code as untrusted and mandates a Docker sandbox (no network, read-only fs, non-root, no docker socket), failing closed. The skill executor (skill_python_executor.py) runs skill Python via a local backend subprocess with no Docker isolation — only a 512 MB RLIMIT and a 7-key env denylist — so a skill executes inside the backend execution context, with filesystem access, network egress, and non-denylisted environment variables that should not be exposed to untrusted/shared skills. In the shipped Docker config (backend runs as root + /var/run/docker.sock mounted), this escalates to host root. This issue has been patched in version 0.0.70." + } + ], + "source": { + "advisory": "GHSA-hcv7-mg77-pg73", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67544.json b/data/2026/67xxx/CVE-2026-67544.json new file mode 100644 index 0000000000..3137b026da --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67544.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67544", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.074Z", + "datePublished": "2026-11-11T21:40:09.660Z", + "dateUpdated": "2026-11-11T21:40:09.660Z" + }, + "containers": { + "cna": { + "title": "Heym: Playwright Custom Code Backend RCE via `playwrightCode` Field", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-94", + "lang": "en", + "description": "CWE-94: Improper Control of Generation of Code", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4" + }, + { + "name": "https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849b", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849b" + }, + { + "name": "https://github.com/heymrun/heym/releases/tag/0.0.71", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/releases/tag/0.0.71" + } + ], + "affected": [ + { + "vendor": "heymrun", + "product": "heym", + "versions": [ + { + "version": "< 0.0.71", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:40:09.660Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This string is written to a temporary .py file and executed directly by the backend process via subprocess.Popen([sys.executable, script_path]) with no sandboxing, AST validation, or role gate. Any authenticated user — including a freshly registered account — can achieve full remote code execution (RCE) on the backend host, running as the service process user (observed as root in the default Docker deployment). This issue has been patched in version 0.0.71." + } + ], + "source": { + "advisory": "GHSA-mp23-7m6r-jfw4", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67545.json b/data/2026/67xxx/CVE-2026-67545.json new file mode 100644 index 0000000000..5568e7a085 --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67545.json @@ -0,0 +1,112 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67545", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.074Z", + "datePublished": "2026-11-11T21:40:31.159Z", + "dateUpdated": "2026-11-11T21:40:31.159Z" + }, + "containers": { + "cna": { + "title": "Heym: Server-Side Request Forgery (SSRF) in HTTP Workflow Node", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-918", + "lang": "en", + "description": "CWE-918: Server-Side Request Forgery", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.4, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/heymrun/heym/security/advisories/GHSA-8wj7-v2w6-wfcx", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/heymrun/heym/security/advisories/GHSA-8wj7-v2w6-wfcx" + }, + { + "name": "https://github.com/heymrun/heym/commit/360a8de56ab9be0b11acdfe89168c5f2d7ab6b1e", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/360a8de56ab9be0b11acdfe89168c5f2d7ab6b1e" + }, + { + "name": "https://github.com/heymrun/heym/commit/583311603f8f81bf2f45a842727046ef17c99c9e", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/583311603f8f81bf2f45a842727046ef17c99c9e" + }, + { + "name": "https://github.com/heymrun/heym/commit/87c216f6e564c58d1dd747115d079fb487233ccf", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/87c216f6e564c58d1dd747115d079fb487233ccf" + }, + { + "name": "https://github.com/heymrun/heym/releases/tag/0.0.73", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/releases/tag/0.0.73" + } + ], + "affected": [ + { + "vendor": "heymrun", + "product": "heym", + "versions": [ + { + "version": "< 0.0.73", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:40:31.159Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.73, the HTTP workflow node in Heym makes outbound HTTP requests to user-supplied URLs without validation of the target host or IP address. If a workflow author has already configured an HTTP node that targets internal addresses such as cloud metadata endpoints or private network hosts, and exposed the workflow with anonymous execution, an unauthenticated attacker can trigger the preconfigured SSRF sink. The same project has comprehensive SSRF protection in its MCP integration, which is absent from the HTTP node. This issue has been patched in version 0.0.73." + } + ], + "source": { + "advisory": "GHSA-8wj7-v2w6-wfcx", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67546.json b/data/2026/67xxx/CVE-2026-67546.json new file mode 100644 index 0000000000..96931e3561 --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67546.json @@ -0,0 +1,105 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67546", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.074Z", + "datePublished": "2026-11-11T21:41:03.020Z", + "dateUpdated": "2026-11-11T21:41:03.020Z" + }, + "containers": { + "cna": { + "title": "Heym: Command execution via POST /api/mcp/fetch-tools stdio transport: supplied command is spawned before MCP validation", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-94", + "lang": "en", + "description": "CWE-94: Improper Control of Generation of Code", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/heymrun/heym/security/advisories/GHSA-378x-q589-34mv", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/heymrun/heym/security/advisories/GHSA-378x-q589-34mv" + }, + { + "name": "https://github.com/heymrun/heym/commit/22b8ee60eb92128cf4ff04a9b6c0e1b62bf25a01", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/22b8ee60eb92128cf4ff04a9b6c0e1b62bf25a01" + }, + { + "name": "https://github.com/heymrun/heym/commit/6c6213f88dfa8b2a70d23a9a271171241e910904", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/commit/6c6213f88dfa8b2a70d23a9a271171241e910904" + }, + { + "name": "https://github.com/heymrun/heym/releases/tag/v0.0.75", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/heymrun/heym/releases/tag/v0.0.75" + } + ], + "affected": [ + { + "vendor": "heymrun", + "product": "heym", + "versions": [ + { + "version": "< 0.0.75", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:41:03.020Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same POST /api/mcp/fetch-tools endpoint (any authenticated user, lowest role) also accepts the stdio transport, which spawns the attacker-supplied command with attacker-supplied args and an environment merged over os.environ. The process executes on the shared backend host before MCP protocol validation fails — so side effects fire regardless of whether the command speaks MCP. This is a distinct weakness class and exploit primitive from the SSRF (Advisory 2) on the same endpoint, and needs a different fix (role gating / opt-in trust boundary rather than egress controls). This issue has been patched in version 0.0.75." + } + ], + "source": { + "advisory": "GHSA-378x-q589-34mv", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67547.json b/data/2026/67xxx/CVE-2026-67547.json new file mode 100644 index 0000000000..f7eb388c26 --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67547.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67547", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.074Z", + "datePublished": "2026-11-11T21:46:37.959Z", + "dateUpdated": "2026-11-11T21:46:37.959Z" + }, + "containers": { + "cna": { + "title": "taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-862", + "lang": "en", + "description": "CWE-862: Missing Authorization", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/jaylfc/taOS/security/advisories/GHSA-h24f-gp4c-8qjm", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/jaylfc/taOS/security/advisories/GHSA-h24f-gp4c-8qjm" + }, + { + "name": "https://github.com/jaylfc/taOS/commit/8998d85190424d5e843880b4ca256e79b653a304", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/jaylfc/taOS/commit/8998d85190424d5e843880b4ca256e79b653a304" + }, + { + "name": "https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.23", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.23" + } + ], + "affected": [ + { + "vendor": "jaylfc", + "product": "taOS", + "versions": [ + { + "version": "< 1.0.0-beta.23", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:46:37.959Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run([\"python3\", \"-c\", code]) — without performing any admin role check, skill ownership check, or agent assignment verification. Any authenticated non-admin user can supply attacker-controlled Python code in the request body and have it executed as the taOS backend process user on the host, achieving full remote code execution with no privilege escalation required beyond a valid (non-admin) session. This issue has been patched in version 1.0.0-beta.23." + } + ], + "source": { + "advisory": "GHSA-h24f-gp4c-8qjm", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/67xxx/CVE-2026-67548.json b/data/2026/67xxx/CVE-2026-67548.json new file mode 100644 index 0000000000..7dba756c7b --- /dev/null +++ b/data/2026/67xxx/CVE-2026-67548.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-67548", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-29T18:47:17.075Z", + "datePublished": "2026-11-11T21:46:13.292Z", + "dateUpdated": "2026-11-11T21:46:13.292Z" + }, + "containers": { + "cna": { + "title": "taOS: Non-Admin Users Can Access System Settings and Update Actions", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-862", + "lang": "en", + "description": "CWE-862: Missing Authorization", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.3, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/jaylfc/taOS/security/advisories/GHSA-47g9-fwwp-hrfp", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/jaylfc/taOS/security/advisories/GHSA-47g9-fwwp-hrfp" + }, + { + "name": "https://github.com/jaylfc/taOS/commit/6e65dd7ddd4b973e326d7ccb0ec74e8eef65374b", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/jaylfc/taOS/commit/6e65dd7ddd4b973e326d7ccb0ec74e8eef65374b" + }, + { + "name": "https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.25", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.25" + } + ], + "affected": [ + { + "vendor": "jaylfc", + "product": "taOS", + "versions": [ + { + "version": "< 1.0.0-beta.25", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:46:13.292Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose is_admin flag is explicitly False—can read the full system configuration, overwrite it, modify platform settings, trigger a git pull + dependency reinstall + service restart, and switch the tracked update branch. Successful exploitation of the write endpoints causes immediate configuration corruption or a denial of service for all users on the instance from a low-privileged account. This issue has been patched in version 1.0.0-beta.25." + } + ], + "source": { + "advisory": "GHSA-47g9-fwwp-hrfp", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/68xxx/CVE-2026-68511.json b/data/2026/68xxx/CVE-2026-68511.json new file mode 100644 index 0000000000..ee793c9dc5 --- /dev/null +++ b/data/2026/68xxx/CVE-2026-68511.json @@ -0,0 +1,94 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-68511", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-30T16:19:08.082Z", + "datePublished": "2026-11-11T21:56:59.654Z", + "dateUpdated": "2026-11-11T21:56:59.654Z" + }, + "containers": { + "cna": { + "title": "Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-362", + "lang": "en", + "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v" + }, + { + "name": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0" + } + ], + "affected": [ + { + "vendor": "WardPearce", + "product": "paaster", + "versions": [ + { + "version": "< 3.3.0", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:56:59.654Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Paaster is a pastebin application. Prior to version 3.3.0, Paaster's \"view once\" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as \"not yet read\" and all successfully retrieve it. This issue has been patched in version 3.3.0." + } + ], + "source": { + "advisory": "GHSA-xh42-5mjw-2f4v", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/68xxx/CVE-2026-68512.json b/data/2026/68xxx/CVE-2026-68512.json new file mode 100644 index 0000000000..0c20c8f2e1 --- /dev/null +++ b/data/2026/68xxx/CVE-2026-68512.json @@ -0,0 +1,104 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-68512", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-30T16:19:08.082Z", + "datePublished": "2026-11-11T21:57:31.618Z", + "dateUpdated": "2026-11-11T21:57:31.618Z" + }, + "containers": { + "cna": { + "title": "Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-204", + "lang": "en", + "description": "CWE-204: Observable Response Discrepancy", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-307", + "lang": "en", + "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", + "version": "4.0" + } + } + ], + "references": [ + { + "name": "https://github.com/WardPearce/paaster/security/advisories/GHSA-9q9w-qhhm-2xwg", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/WardPearce/paaster/security/advisories/GHSA-9q9w-qhhm-2xwg" + }, + { + "name": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/WardPearce/paaster/releases/tag/v3.3.0" + } + ], + "affected": [ + { + "vendor": "WardPearce", + "product": "paaster", + "versions": [ + { + "version": "< 3.3.0", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T21:57:31.618Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0." + } + ], + "source": { + "advisory": "GHSA-9q9w-qhhm-2xwg", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/68xxx/CVE-2026-68538.json b/data/2026/68xxx/CVE-2026-68538.json new file mode 100644 index 0000000000..0fdd39a73c --- /dev/null +++ b/data/2026/68xxx/CVE-2026-68538.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-68538", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-30T19:56:44.101Z", + "datePublished": "2026-11-11T22:12:06.386Z", + "dateUpdated": "2026-11-11T22:12:06.386Z" + }, + "containers": { + "cna": { + "title": "fulgur: Unbounded counters() expansion in generated content causes memory/CPU exhaustion (denial of service)", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-400", + "lang": "en", + "description": "CWE-400: Uncontrolled Resource Consumption", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-395p-pj7r-jm42", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-395p-pj7r-jm42" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/commit/ebc75691ad368f1c1a211543313b04da2af466d6", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/commit/ebc75691ad368f1c1a211543313b04da2af466d6" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/releases/tag/v0.27.0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/releases/tag/v0.27.0" + } + ], + "affected": [ + { + "vendor": "fulgur-rs", + "product": "fulgur", + "versions": [ + { + "version": ">= 0.15.0, < 0.27.0", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T22:12:06.386Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither in the size of a single expansion nor in the aggregate work across an element tree. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger CPU and memory exhaustion with a trivially small payload, denying service to the host and any co-tenants. This issue has been patched in version 0.27.0." + } + ], + "source": { + "advisory": "GHSA-395p-pj7r-jm42", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/68xxx/CVE-2026-68539.json b/data/2026/68xxx/CVE-2026-68539.json new file mode 100644 index 0000000000..242ed822c0 --- /dev/null +++ b/data/2026/68xxx/CVE-2026-68539.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-68539", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-30T19:56:44.101Z", + "datePublished": "2026-11-11T22:12:18.353Z", + "dateUpdated": "2026-11-11T22:12:18.353Z" + }, + "containers": { + "cna": { + "title": "fulgur: Unbounded string-set value accumulation causes memory/CPU exhaustion (denial of service)", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-400", + "lang": "en", + "description": "CWE-400: Uncontrolled Resource Consumption", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-770", + "lang": "en", + "description": "CWE-770: Allocation of Resources Without Limits or Throttling", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/pull/582", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/pull/582" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/pull/584", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/pull/584" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0" + } + ], + "affected": [ + { + "vendor": "fulgur-rs", + "product": "fulgur", + "versions": [ + { + "version": ">= 0.4.4, < 0.29.0", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T22:12:18.353Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0." + } + ], + "source": { + "advisory": "GHSA-vw2v-g4x7-xcqg", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/68xxx/CVE-2026-68540.json b/data/2026/68xxx/CVE-2026-68540.json new file mode 100644 index 0000000000..e31adc4f8d --- /dev/null +++ b/data/2026/68xxx/CVE-2026-68540.json @@ -0,0 +1,115 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-68540", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-30T19:56:44.101Z", + "datePublished": "2026-11-11T22:12:33.400Z", + "dateUpdated": "2026-11-11T22:12:33.400Z" + }, + "containers": { + "cna": { + "title": "fulgur: Quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements causes denial of servicefulgur:", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-400", + "lang": "en", + "description": "CWE-400: Uncontrolled Resource Consumption", + "type": "CWE" + } + ] + }, + { + "descriptions": [ + { + "cweId": "CWE-405", + "lang": "en", + "description": "CWE-405: Asymmetric Resource Consumption (Amplification)", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-v8x5-rchq-jr47", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-v8x5-rchq-jr47" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/pull/602", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/pull/602" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/commit/8fabbca271313c56ef48f1d20d0040e1cf130de5", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/commit/8fabbca271313c56ef48f1d20d0040e1cf130de5" + }, + { + "name": "https://github.com/fulgur-rs/fulgur/releases/tag/v0.33.0", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/fulgur-rs/fulgur/releases/tag/v0.33.0" + } + ], + "affected": [ + { + "vendor": "fulgur-rs", + "product": "fulgur", + "versions": [ + { + "version": ">= 0.6.0, < 0.33.0", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T22:12:33.400Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0." + } + ], + "source": { + "advisory": "GHSA-v8x5-rchq-jr47", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/2026/68xxx/CVE-2026-68549.json b/data/2026/68xxx/CVE-2026-68549.json new file mode 100644 index 0000000000..a5fa4c0f03 --- /dev/null +++ b/data/2026/68xxx/CVE-2026-68549.json @@ -0,0 +1,98 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-68549", + "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "state": "PUBLISHED", + "assignerShortName": "GitHub_M", + "dateReserved": "2026-07-30T19:56:44.101Z", + "datePublished": "2026-11-11T22:14:50.340Z", + "dateUpdated": "2026-11-11T22:14:50.340Z" + }, + "containers": { + "cna": { + "title": "ClickMigrate has Path Traversal in \"revision -m\" argument", + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-22", + "lang": "en", + "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory", + "type": "CWE" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "attackComplexity": "LOW", + "attackVector": "LOCAL", + "availabilityImpact": "NONE", + "baseScore": 3.3, + "baseSeverity": "LOW", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "version": "3.1" + } + } + ], + "references": [ + { + "name": "https://github.com/QueueForge/ClickMigrate/security/advisories/GHSA-vgf9-9mxx-hq54", + "tags": [ + "x_refsource_CONFIRM" + ], + "url": "https://github.com/QueueForge/ClickMigrate/security/advisories/GHSA-vgf9-9mxx-hq54" + }, + { + "name": "https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/QueueForge/ClickMigrate/commit/6b1f2c0202630a82252b3331aa57e64327e112b6" + }, + { + "name": "https://github.com/QueueForge/ClickMigrate/releases/tag/v1.0.3", + "tags": [ + "x_refsource_MISC" + ], + "url": "https://github.com/QueueForge/ClickMigrate/releases/tag/v1.0.3" + } + ], + "affected": [ + { + "vendor": "QueueForge", + "product": "ClickMigrate", + "versions": [ + { + "version": "< 1.0.3", + "status": "affected" + } + ] + } + ], + "providerMetadata": { + "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", + "shortName": "GitHub_M", + "dateUpdated": "2026-11-11T22:14:50.340Z" + }, + "descriptions": [ + { + "lang": "en", + "value": "ClickMigrate is a database migration tool for ClickHouse with automatic SQL migration management and version tracking. Prior to version 1.0.3, a path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations directory. Under specific conditions, an attacker could cause the tool to create a .sql file in an arbitrary location writable by the user executing the command. This issue is only exploitable if an attacker can influence the migration name passed to the revision command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input. This issue has been patched in version 1.0.3." + } + ], + "source": { + "advisory": "GHSA-vgf9-9mxx-hq54", + "discovery": "UNKNOWN" + } + } + } +} \ No newline at end of file diff --git a/data/delta.json b/data/delta.json index d2b6ea8fa4..5124e5e1c4 100644 --- a/data/delta.json +++ b/data/delta.json @@ -1,36 +1,18 @@ { - "fetchTime": "2026-11-11T21:18:55.665Z", - "numberOfChanges": 5, + "fetchTime": "2026-11-11T22:19:25.240Z", + "numberOfChanges": 2, "new": [ { - "cveId": "CVE-2026-65949", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65949", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65949.json", - "dateUpdated": "2026-11-11T21:11:31.703Z" + "cveId": "CVE-2026-107922", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107922", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107922.json", + "dateUpdated": "2026-11-11T22:18:59.410Z" }, { - "cveId": "CVE-2026-65950", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65950", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65950.json", - "dateUpdated": "2026-11-11T21:12:13.454Z" - }, - { - "cveId": "CVE-2026-65951", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65951", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65951.json", - "dateUpdated": "2026-11-11T21:12:32.138Z" - }, - { - "cveId": "CVE-2026-65952", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65952", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65952.json", - "dateUpdated": "2026-11-11T21:12:45.844Z" - }, - { - "cveId": "CVE-2026-81936", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-81936", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81936.json", - "dateUpdated": "2026-11-11T21:13:17.524Z" + "cveId": "CVE-2026-68549", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68549", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68549.json", + "dateUpdated": "2026-11-11T22:14:50.340Z" } ], "updated": [], diff --git a/data/deltaLog.json b/data/deltaLog.json index d641528dd8..73406a776e 100644 --- a/data/deltaLog.json +++ b/data/deltaLog.json @@ -1,4 +1,785 @@ [ + { + "fetchTime": "2026-11-11T22:19:25.240Z", + "numberOfChanges": 2, + "new": [ + { + "cveId": "CVE-2026-107922", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107922", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107922.json", + "dateUpdated": "2026-11-11T22:18:59.410Z" + }, + { + "cveId": "CVE-2026-68549", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68549", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68549.json", + "dateUpdated": "2026-11-11T22:14:50.340Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T22:13:40.595Z", + "numberOfChanges": 3, + "new": [ + { + "cveId": "CVE-2026-68538", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68538", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68538.json", + "dateUpdated": "2026-11-11T22:12:06.386Z" + }, + { + "cveId": "CVE-2026-68539", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68539", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68539.json", + "dateUpdated": "2026-11-11T22:12:18.353Z" + }, + { + "cveId": "CVE-2026-68540", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68540", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68540.json", + "dateUpdated": "2026-11-11T22:12:33.400Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T22:02:01.965Z", + "numberOfChanges": 3, + "new": [ + { + "cveId": "CVE-2026-111521", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111521", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111521.json", + "dateUpdated": "2026-11-11T21:57:00.847Z" + }, + { + "cveId": "CVE-2026-68511", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68511", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68511.json", + "dateUpdated": "2026-11-11T21:56:59.654Z" + }, + { + "cveId": "CVE-2026-68512", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68512", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68512.json", + "dateUpdated": "2026-11-11T21:57:31.618Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T21:56:05.592Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2026-67449", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67449", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67449.json", + "dateUpdated": "2026-11-11T21:51:23.105Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T21:50:16.878Z", + "numberOfChanges": 3, + "new": [ + { + "cveId": "CVE-2026-65971", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65971", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65971.json", + "dateUpdated": "2026-11-11T21:49:12.607Z" + }, + { + "cveId": "CVE-2026-67547", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67547", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67547.json", + "dateUpdated": "2026-11-11T21:46:37.959Z" + }, + { + "cveId": "CVE-2026-67548", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67548", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67548.json", + "dateUpdated": "2026-11-11T21:46:13.292Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T21:44:04.257Z", + "numberOfChanges": 7, + "new": [ + { + "cveId": "CVE-2026-67540", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67540", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67540.json", + "dateUpdated": "2026-11-11T21:38:28.344Z" + }, + { + "cveId": "CVE-2026-67541", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67541", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67541.json", + "dateUpdated": "2026-11-11T21:39:02.673Z" + }, + { + "cveId": "CVE-2026-67542", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67542", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67542.json", + "dateUpdated": "2026-11-11T21:39:24.809Z" + }, + { + "cveId": "CVE-2026-67543", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67543", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67543.json", + "dateUpdated": "2026-11-11T21:39:53.192Z" + }, + { + "cveId": "CVE-2026-67544", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67544", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67544.json", + "dateUpdated": "2026-11-11T21:40:09.660Z" + }, + { + "cveId": "CVE-2026-67545", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67545", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67545.json", + "dateUpdated": "2026-11-11T21:40:31.159Z" + }, + { + "cveId": "CVE-2026-67546", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-67546", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67546.json", + "dateUpdated": "2026-11-11T21:41:03.020Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T21:38:09.305Z", + "numberOfChanges": 22, + "new": [ + { + "cveId": "CVE-2026-121526", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121526", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121526.json", + "dateUpdated": "2026-11-11T21:31:49.831Z" + }, + { + "cveId": "CVE-2026-121527", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121527", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121527.json", + "dateUpdated": "2026-11-11T21:31:52.231Z" + }, + { + "cveId": "CVE-2026-121528", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121528", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121528.json", + "dateUpdated": "2026-11-11T21:31:53.978Z" + }, + { + "cveId": "CVE-2026-126229", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126229", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126229.json", + "dateUpdated": "2026-11-11T21:35:18.269Z" + }, + { + "cveId": "CVE-2026-126245", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126245", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126245.json", + "dateUpdated": "2026-11-11T21:31:40.840Z" + }, + { + "cveId": "CVE-2026-126246", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126246", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126246.json", + "dateUpdated": "2026-11-11T21:31:42.366Z" + }, + { + "cveId": "CVE-2026-126247", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126247", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126247.json", + "dateUpdated": "2026-11-11T21:31:41.907Z" + }, + { + "cveId": "CVE-2026-126248", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126248", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126248.json", + "dateUpdated": "2026-11-11T21:31:44.940Z" + }, + { + "cveId": "CVE-2026-126249", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126249", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126249.json", + "dateUpdated": "2026-11-11T21:31:42.156Z" + }, + { + "cveId": "CVE-2026-126250", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126250", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126250.json", + "dateUpdated": "2026-11-11T21:31:45.240Z" + }, + { + "cveId": "CVE-2026-126251", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126251", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126251.json", + "dateUpdated": "2026-11-11T21:31:45.917Z" + }, + { + "cveId": "CVE-2026-126252", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126252", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126252.json", + "dateUpdated": "2026-11-11T21:31:46.520Z" + }, + { + "cveId": "CVE-2026-126253", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126253", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126253.json", + "dateUpdated": "2026-11-11T21:31:47.633Z" + }, + { + "cveId": "CVE-2026-126254", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126254", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126254.json", + "dateUpdated": "2026-11-11T21:31:50.608Z" + }, + { + "cveId": "CVE-2026-126255", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126255", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126255.json", + "dateUpdated": "2026-11-11T21:31:52.405Z" + }, + { + "cveId": "CVE-2026-126256", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126256", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126256.json", + "dateUpdated": "2026-11-11T21:31:52.364Z" + }, + { + "cveId": "CVE-2026-126257", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126257", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126257.json", + "dateUpdated": "2026-11-11T21:31:50.497Z" + }, + { + "cveId": "CVE-2026-126258", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126258", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126258.json", + "dateUpdated": "2026-11-11T21:31:50.602Z" + }, + { + "cveId": "CVE-2026-126259", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126259", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126259.json", + "dateUpdated": "2026-11-11T21:31:53.632Z" + }, + { + "cveId": "CVE-2026-126262", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126262", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126262.json", + "dateUpdated": "2026-11-11T21:31:54.288Z" + }, + { + "cveId": "CVE-2026-126263", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126263", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126263.json", + "dateUpdated": "2026-11-11T21:31:52.954Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-103038", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103038", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103038.json", + "dateUpdated": "2026-11-11T21:34:36.705Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T21:31:40.916Z", + "numberOfChanges": 74, + "new": [ + { + "cveId": "CVE-2026-126144", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126144", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126144.json", + "dateUpdated": "2026-11-11T21:28:56.637Z" + }, + { + "cveId": "CVE-2026-126145", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126145", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126145.json", + "dateUpdated": "2026-11-11T21:28:54.772Z" + }, + { + "cveId": "CVE-2026-126146", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126146", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126146.json", + "dateUpdated": "2026-11-11T21:28:58.040Z" + }, + { + "cveId": "CVE-2026-126147", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126147", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126147.json", + "dateUpdated": "2026-11-11T21:29:16.713Z" + }, + { + "cveId": "CVE-2026-126148", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126148", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126148.json", + "dateUpdated": "2026-11-11T21:28:59.138Z" + }, + { + "cveId": "CVE-2026-126149", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126149", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126149.json", + "dateUpdated": "2026-11-11T21:29:03.844Z" + }, + { + "cveId": "CVE-2026-126150", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126150", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126150.json", + "dateUpdated": "2026-11-11T21:29:00.809Z" + }, + { + "cveId": "CVE-2026-126151", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126151", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126151.json", + "dateUpdated": "2026-11-11T21:29:14.136Z" + }, + { + "cveId": "CVE-2026-126152", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126152", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126152.json", + "dateUpdated": "2026-11-11T21:29:14.754Z" + }, + { + "cveId": "CVE-2026-126153", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126153", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126153.json", + "dateUpdated": "2026-11-11T21:29:13.400Z" + }, + { + "cveId": "CVE-2026-126154", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126154", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126154.json", + "dateUpdated": "2026-11-11T21:29:13.715Z" + }, + { + "cveId": "CVE-2026-126155", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126155", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126155.json", + "dateUpdated": "2026-11-11T21:29:10.341Z" + }, + { + "cveId": "CVE-2026-126156", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126156", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126156.json", + "dateUpdated": "2026-11-11T21:29:14.950Z" + }, + { + "cveId": "CVE-2026-126157", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126157", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126157.json", + "dateUpdated": "2026-11-11T21:29:09.159Z" + }, + { + "cveId": "CVE-2026-126158", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126158", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126158.json", + "dateUpdated": "2026-11-11T21:29:12.696Z" + }, + { + "cveId": "CVE-2026-126159", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126159", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126159.json", + "dateUpdated": "2026-11-11T21:29:17.990Z" + }, + { + "cveId": "CVE-2026-126160", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126160", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126160.json", + "dateUpdated": "2026-11-11T21:29:19.376Z" + }, + { + "cveId": "CVE-2026-126161", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126161", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126161.json", + "dateUpdated": "2026-11-11T21:29:23.614Z" + }, + { + "cveId": "CVE-2026-126162", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126162", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126162.json", + "dateUpdated": "2026-11-11T21:29:21.221Z" + }, + { + "cveId": "CVE-2026-126163", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126163", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126163.json", + "dateUpdated": "2026-11-11T21:29:25.391Z" + }, + { + "cveId": "CVE-2026-126164", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126164", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126164.json", + "dateUpdated": "2026-11-11T21:29:26.070Z" + }, + { + "cveId": "CVE-2026-126165", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126165", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126165.json", + "dateUpdated": "2026-11-11T21:29:24.082Z" + }, + { + "cveId": "CVE-2026-126166", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126166", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126166.json", + "dateUpdated": "2026-11-11T21:30:03.160Z" + }, + { + "cveId": "CVE-2026-126167", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126167", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126167.json", + "dateUpdated": "2026-11-11T21:29:59.621Z" + }, + { + "cveId": "CVE-2026-126168", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126168", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126168.json", + "dateUpdated": "2026-11-11T21:30:00.722Z" + }, + { + "cveId": "CVE-2026-126169", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126169", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126169.json", + "dateUpdated": "2026-11-11T21:30:03.318Z" + }, + { + "cveId": "CVE-2026-126170", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126170", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126170.json", + "dateUpdated": "2026-11-11T21:30:02.652Z" + }, + { + "cveId": "CVE-2026-126171", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126171", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126171.json", + "dateUpdated": "2026-11-11T21:29:59.692Z" + }, + { + "cveId": "CVE-2026-126175", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126175", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126175.json", + "dateUpdated": "2026-11-11T21:30:07.098Z" + }, + { + "cveId": "CVE-2026-126176", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126176", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126176.json", + "dateUpdated": "2026-11-11T21:30:30.791Z" + }, + { + "cveId": "CVE-2026-126177", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126177", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126177.json", + "dateUpdated": "2026-11-11T21:30:30.450Z" + }, + { + "cveId": "CVE-2026-126178", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126178", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126178.json", + "dateUpdated": "2026-11-11T21:30:26.569Z" + }, + { + "cveId": "CVE-2026-126179", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126179", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126179.json", + "dateUpdated": "2026-11-11T21:30:04.164Z" + }, + { + "cveId": "CVE-2026-126180", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126180", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126180.json", + "dateUpdated": "2026-11-11T21:30:00.428Z" + }, + { + "cveId": "CVE-2026-126181", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126181", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126181.json", + "dateUpdated": "2026-11-11T21:29:57.274Z" + }, + { + "cveId": "CVE-2026-126182", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126182", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126182.json", + "dateUpdated": "2026-11-11T21:30:30.930Z" + }, + { + "cveId": "CVE-2026-126183", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126183", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126183.json", + "dateUpdated": "2026-11-11T21:30:33.338Z" + }, + { + "cveId": "CVE-2026-126184", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126184", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126184.json", + "dateUpdated": "2026-11-11T21:30:34.611Z" + }, + { + "cveId": "CVE-2026-126185", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126185", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126185.json", + "dateUpdated": "2026-11-11T21:30:50.443Z" + }, + { + "cveId": "CVE-2026-126211", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126211", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126211.json", + "dateUpdated": "2026-11-11T21:31:07.366Z" + }, + { + "cveId": "CVE-2026-126212", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126212", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126212.json", + "dateUpdated": "2026-11-11T21:30:33.664Z" + }, + { + "cveId": "CVE-2026-126213", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126213", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126213.json", + "dateUpdated": "2026-11-11T21:31:03.916Z" + }, + { + "cveId": "CVE-2026-126214", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126214", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126214.json", + "dateUpdated": "2026-11-11T21:31:34.736Z" + }, + { + "cveId": "CVE-2026-126215", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126215", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126215.json", + "dateUpdated": "2026-11-11T21:31:29.491Z" + }, + { + "cveId": "CVE-2026-126216", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126216", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126216.json", + "dateUpdated": "2026-11-11T21:31:33.421Z" + }, + { + "cveId": "CVE-2026-126217", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126217", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126217.json", + "dateUpdated": "2026-11-11T21:31:29.318Z" + }, + { + "cveId": "CVE-2026-126218", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126218", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126218.json", + "dateUpdated": "2026-11-11T21:30:53.697Z" + }, + { + "cveId": "CVE-2026-126219", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126219", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126219.json", + "dateUpdated": "2026-11-11T21:31:24.283Z" + }, + { + "cveId": "CVE-2026-126220", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126220", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126220.json", + "dateUpdated": "2026-11-11T21:31:24.528Z" + }, + { + "cveId": "CVE-2026-126221", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126221", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126221.json", + "dateUpdated": "2026-11-11T21:31:22.961Z" + }, + { + "cveId": "CVE-2026-126222", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126222", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126222.json", + "dateUpdated": "2026-11-11T21:31:11.250Z" + }, + { + "cveId": "CVE-2026-126223", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126223", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126223.json", + "dateUpdated": "2026-11-11T21:30:34.728Z" + }, + { + "cveId": "CVE-2026-126224", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126224", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126224.json", + "dateUpdated": "2026-11-11T21:31:33.631Z" + }, + { + "cveId": "CVE-2026-126225", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126225", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126225.json", + "dateUpdated": "2026-11-11T21:31:27.084Z" + }, + { + "cveId": "CVE-2026-126226", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126226", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126226.json", + "dateUpdated": "2026-11-11T21:30:42.152Z" + }, + { + "cveId": "CVE-2026-126227", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126227", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126227.json", + "dateUpdated": "2026-11-11T21:31:25.884Z" + }, + { + "cveId": "CVE-2026-126228", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126228", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126228.json", + "dateUpdated": "2026-11-11T21:31:30.119Z" + }, + { + "cveId": "CVE-2026-126230", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126230", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126230.json", + "dateUpdated": "2026-11-11T21:30:40.873Z" + }, + { + "cveId": "CVE-2026-126231", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126231", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126231.json", + "dateUpdated": "2026-11-11T21:30:39.172Z" + }, + { + "cveId": "CVE-2026-126232", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126232", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126232.json", + "dateUpdated": "2026-11-11T21:30:46.856Z" + }, + { + "cveId": "CVE-2026-126233", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126233", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126233.json", + "dateUpdated": "2026-11-11T21:31:21.093Z" + }, + { + "cveId": "CVE-2026-126234", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126234", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126234.json", + "dateUpdated": "2026-11-11T21:31:21.596Z" + }, + { + "cveId": "CVE-2026-126235", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126235", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126235.json", + "dateUpdated": "2026-11-11T21:31:23.876Z" + }, + { + "cveId": "CVE-2026-126236", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126236", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126236.json", + "dateUpdated": "2026-11-11T21:31:36.058Z" + }, + { + "cveId": "CVE-2026-126237", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126237", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126237.json", + "dateUpdated": "2026-11-11T21:31:22.149Z" + }, + { + "cveId": "CVE-2026-126238", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126238", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126238.json", + "dateUpdated": "2026-11-11T21:31:27.516Z" + }, + { + "cveId": "CVE-2026-126239", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126239", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126239.json", + "dateUpdated": "2026-11-11T21:31:35.102Z" + }, + { + "cveId": "CVE-2026-126240", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126240", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126240.json", + "dateUpdated": "2026-11-11T21:31:29.472Z" + }, + { + "cveId": "CVE-2026-126241", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126241", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126241.json", + "dateUpdated": "2026-11-11T21:31:35.181Z" + }, + { + "cveId": "CVE-2026-126242", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126242", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126242.json", + "dateUpdated": "2026-11-11T21:31:20.079Z" + }, + { + "cveId": "CVE-2026-126243", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126243", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126243.json", + "dateUpdated": "2026-11-11T21:31:21.473Z" + }, + { + "cveId": "CVE-2026-126244", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126244", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126244.json", + "dateUpdated": "2026-11-11T21:31:38.071Z" + }, + { + "cveId": "CVE-2026-126326", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126326", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126326.json", + "dateUpdated": "2026-11-11T21:25:53.824Z" + }, + { + "cveId": "CVE-2026-126332", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126332", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126332.json", + "dateUpdated": "2026-11-11T21:27:17.764Z" + } + ], + "updated": [], + "error": [] + }, + { + "fetchTime": "2026-11-11T21:25:54.207Z", + "numberOfChanges": 3, + "new": [ + { + "cveId": "CVE-2026-126327", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126327", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126327.json", + "dateUpdated": "2026-11-11T21:21:15.449Z" + }, + { + "cveId": "CVE-2026-126328", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126328", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126328.json", + "dateUpdated": "2026-11-11T21:23:00.048Z" + }, + { + "cveId": "CVE-2026-126331", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126331", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126331.json", + "dateUpdated": "2026-11-11T21:24:17.153Z" + } + ], + "updated": [], + "error": [] + }, { "fetchTime": "2026-11-11T21:18:55.665Z", "numberOfChanges": 5, @@ -848302,166 +849083,5 @@ } ], "error": [] - }, - { - "fetchTime": "2026-10-12T22:00:42.708Z", - "numberOfChanges": 4, - "new": [ - { - "cveId": "CVE-2026-102596", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102596", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102596.json", - "dateUpdated": "2026-10-12T21:58:26.250Z" - }, - { - "cveId": "CVE-2026-108934", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108934", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108934.json", - "dateUpdated": "2026-10-12T22:00:16.792Z" - }, - { - "cveId": "CVE-2026-44828", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-44828", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/44xxx/CVE-2026-44828.json", - "dateUpdated": "2026-10-12T21:56:35.696Z" - }, - { - "cveId": "CVE-2026-54459", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54459", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54459.json", - "dateUpdated": "2026-10-12T21:55:15.872Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T21:54:49.089Z", - "numberOfChanges": 1, - "new": [ - { - "cveId": "CVE-2026-104140", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104140", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104140.json", - "dateUpdated": "2026-10-12T21:53:29.041Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T21:47:43.799Z", - "numberOfChanges": 7, - "new": [ - { - "cveId": "CVE-2026-108933", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108933", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108933.json", - "dateUpdated": "2026-10-12T21:45:11.710Z" - }, - { - "cveId": "CVE-2026-49484", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-49484", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49484.json", - "dateUpdated": "2026-10-12T21:37:50.356Z" - }, - { - "cveId": "CVE-2026-90911", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90911", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90911.json", - "dateUpdated": "2026-10-12T21:43:59.019Z" - }, - { - "cveId": "CVE-2026-90912", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90912", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90912.json", - "dateUpdated": "2026-10-12T21:43:46.968Z" - }, - { - "cveId": "CVE-2026-90920", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90920", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90920.json", - "dateUpdated": "2026-10-12T21:43:33.003Z" - }, - { - "cveId": "CVE-2026-90921", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90921", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90921.json", - "dateUpdated": "2026-10-12T21:43:07.931Z" - }, - { - "cveId": "CVE-2026-92876", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92876", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92876.json", - "dateUpdated": "2026-10-12T21:42:42.280Z" - } - ], - "updated": [], - "error": [] - }, - { - "fetchTime": "2026-10-12T21:37:43.374Z", - "numberOfChanges": 4, - "new": [ - { - "cveId": "CVE-2026-108932", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108932", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108932.json", - "dateUpdated": "2026-10-12T21:30:15.257Z" - }, - { - "cveId": "CVE-2026-49483", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-49483", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49483.json", - "dateUpdated": "2026-10-12T21:36:10.390Z" - }, - { - "cveId": "CVE-2026-53922", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-53922", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53922.json", - "dateUpdated": "2026-10-12T21:31:24.809Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-66787", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-66787", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66787.json", - "dateUpdated": "2026-10-12T21:29:22.436Z" - } - ], - "error": [] - }, - { - "fetchTime": "2026-10-12T21:27:21.042Z", - "numberOfChanges": 4, - "new": [ - { - "cveId": "CVE-2026-102539", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102539", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102539.json", - "dateUpdated": "2026-10-12T21:22:04.409Z" - }, - { - "cveId": "CVE-2026-103658", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103658", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103658.json", - "dateUpdated": "2026-10-12T21:24:48.600Z" - }, - { - "cveId": "CVE-2026-41210", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-41210", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41210.json", - "dateUpdated": "2026-10-12T21:25:03.303Z" - }, - { - "cveId": "CVE-2026-84312", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84312", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84312.json", - "dateUpdated": "2026-10-12T21:16:56.072Z" - } - ], - "updated": [], - "error": [] } ] \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index b9193e1780..e9d2c5d3df 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,7 +1,7 @@ { "source": "https://github.com/CVEProject/cvelistV5.git", - "upstream_commit": "6bd5b856aa81f101b3fd43fa4d22c31013aa399b", + "upstream_commit": "c22b909bf490e58c52c0f4f55c3e1ab74ae9974e", "since_year": 2017, - "records": 331183, - "synced_at_utc": "2026-11-11T21:29:06.400163+00:00" + "records": 331300, + "synced_at_utc": "2026-11-11T22:27:44.565536+00:00" }