diff --git a/data/2024/CVE-2024-58406.json b/data/2024/CVE-2024-58406.json
new file mode 100644
index 0000000000..e9371bda10
--- /dev/null
+++ b/data/2024/CVE-2024-58406.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Huatian Dynamic OA8000","vendor":"Dalian Huatian Software Co., Ltd.","versions":[{"status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20."}],"id":"CVE-2024-58406","lastModified":"2026-11-13T16:17:18.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:17:18.497","references":[{"source":"disclosure@vulncheck.com","url":"https://cn-sec.com/archives/2540697.html"},{"source":"disclosure@vulncheck.com","url":"https://www.oa8000.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/huatian-oa8000-path-traversal-via-ntkodownload-jsp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2025/CVE-2025-41725.json b/data/2025/CVE-2025-41725.json
index 5d16f66a09..5cf7aa6788 100644
--- a/data/2025/CVE-2025-41725.json
+++ b/data/2025/CVE-2025-41725.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Flip 4","vendor":"Harman International","versions":[{"lessThan":"4.1.0","status":"affected","version":"0.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker."}],"id":"CVE-2025-41725","lastModified":"2026-11-13T13:17:38.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}]},"published":"2026-11-13T13:17:38.957","references":[{"source":"info@cert.vde.com","url":"https://certvde.com/en/advisories/VDE-2025-090/"},{"source":"info@cert.vde.com","url":"https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2026/hbsa-2025-0003.json"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-923"}],"source":"info@cert.vde.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Flip 4","vendor":"JBL","versions":[{"lessThan":"4.1.0","status":"affected","version":"0.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker."}],"id":"CVE-2025-41725","lastModified":"2026-11-13T15:17:27.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-13T13:17:38.957","references":[{"source":"info@cert.vde.com","url":"https://certvde.com/en/advisories/VDE-2025-090/"},{"source":"info@cert.vde.com","url":"https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2026/hbsa-2025-0003.json"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-923"}],"source":"info@cert.vde.com","type":"Secondary"}]}
diff --git a/data/2025/CVE-2025-4637.json b/data/2025/CVE-2025-4637.json
index 5f1b9cf363..1f35e44a45 100644
--- a/data/2025/CVE-2025-4637.json
+++ b/data/2025/CVE-2025-4637.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"dlib","vendor":"davisking","versions":[{"changes":[{"at":"patch 19.24.7","status":"unaffected"}],"lessThan":"<19.24.7","status":"affected","version":"0","versionType":"git"}]}],"source":"cve_disclosure@tech.gov.sg"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Divide By Zero vulnerability in davisking dlib allows \n\nremote attackers to cause a denial of service via a crafted file.\n\n.This issue affects dlib: before <19.24.7."},{"lang":"es","value":"La vulnerabilidad Divide By Zero en davisking dlib permite a atacantes remotos provocar una denegación de servicio a través de un archivo manipulado. Este problema afecta a dlib: anteriores a &lt;19.24.7."}],"id":"CVE-2025-4637","lastModified":"2026-06-17T09:33:39.560","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-15T14:26:49.348017Z","version":"2.0.3"}}]},"published":"2025-05-14T18:15:33.353","references":[{"source":"cve_disclosure@tech.gov.sg","url":"https://github.com/davisking/dlib/pull/3058"}],"sourceIdentifier":"cve_disclosure@tech.gov.sg","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"dlib","vendor":"davisking","versions":[{"changes":[{"at":"patch 19.24.7","status":"unaffected"}],"lessThan":"<19.24.7","status":"affected","version":"0","versionType":"git"}]}],"source":"cve_disclosure@tech.gov.sg"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Divide By Zero vulnerability in davisking dlib allows \n\nremote attackers to cause a denial of service via a crafted file.\n\n.This issue affects dlib: before <19.24.7."},{"lang":"es","value":"La vulnerabilidad Divide By Zero en davisking dlib permite a atacantes remotos provocar una denegación de servicio a través de un archivo manipulado. Este problema afecta a dlib: anteriores a &lt;19.24.7."}],"id":"CVE-2025-4637","lastModified":"2026-11-13T16:06:41.693","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-15T14:26:49.348017Z","version":"2.0.3"}}]},"published":"2025-05-14T18:15:33.353","references":[{"source":"cve_disclosure@tech.gov.sg","url":"https://github.com/davisking/dlib/pull/3058"}],"sourceIdentifier":"cve_disclosure@tech.gov.sg","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}]}
diff --git a/data/2025/CVE-2025-71462.json b/data/2025/CVE-2025-71462.json
index 47eae17849..8af9e3d50c 100644
--- a/data/2025/CVE-2025-71462.json
+++ b/data/2025/CVE-2025-71462.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"3.7.12","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.7.12","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login."}],"id":"CVE-2025-71462","lastModified":"2026-11-13T10:17:24.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:24.250","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"3.7.12","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.7.12","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login."}],"id":"CVE-2025-71462","lastModified":"2026-11-13T16:17:18.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:54.975130Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:24.250","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-0191.json b/data/2026/CVE-2026-0191.json
index ef94efdf53..04608fb79c 100644
--- a/data/2026/CVE-2026-0191.json
+++ b/data/2026/CVE-2026-0191.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-0191","lastModified":"2026-11-13T05:17:46.637","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.730","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-0191","lastModified":"2026-11-13T15:17:28.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:35.257827Z","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.730","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-0193.json b/data/2026/CVE-2026-0193.json
index 8ce4646be9..7fc1eea703 100644
--- a/data/2026/CVE-2026-0193.json
+++ b/data/2026/CVE-2026-0193.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-0193","lastModified":"2026-11-10T21:46:38.130","metrics":{},"published":"2026-11-10T20:17:20.840","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-0193","lastModified":"2026-11-13T16:17:19.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:24:10.890353Z","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.840","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-0195.json b/data/2026/CVE-2026-0195.json
index eaef9facca..77789192bb 100644
--- a/data/2026/CVE-2026-0195.json
+++ b/data/2026/CVE-2026-0195.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0195","lastModified":"2026-11-10T21:46:41.827","metrics":{},"published":"2026-11-10T20:17:20.940","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0195","lastModified":"2026-11-13T16:17:20.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0195","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:24:53.173487Z","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.940","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-100080.json b/data/2026/CVE-2026-100080.json
index afc1322db5..d5def28fdc 100644
--- a/data/2026/CVE-2026-100080.json
+++ b/data/2026/CVE-2026-100080.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4223b33be49ee09acb6f1d26beb4a36dd3b8d63a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ab9cdf1291be551da999510b30216a2886074d7a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"36f858f228e3f955b9336af7f94634747c221518","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"89e534265b62c94749639350200b10370564bb3a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6cd611d2abdd8623a554e14145f82c1cb4e4467a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"37d5a73170579b30e67cc8b19ec69715eea3a6b6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"4867687b6ad28ab84bc0811d8f8f9972e769da02","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5.10.274","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.15.225","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.1.192","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.6.162","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.12.116","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.18.62","status":"affected","version":"0","versionType":"semver"},{"lessThan":"7.3.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.274","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.225","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.192","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.162","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.116","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.62","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.3","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix UAF when reading statistics data\n\nThe network statistic data in the driver is protected by RCU.\nUnfortunately when tearing down the queues after an error during\nconnecting to the frontend (e.g. due to illegal Xenstore data filled\nin by the guest), the statistic data is being freed without\nsynchronizing the RCU state.  In case the data is being read via sysfs\nin this phase, access to already freed memory or memory being in new\nuse is possible.\n\nFix that by calling synchronize_net() before freeing the queue data.\n\nThis is XSA-526 / CVE-2026-100080"}],"id":"CVE-2026-100080","lastModified":"2026-11-06T19:17:03.190","metrics":{},"published":"2026-11-06T19:17:03.190","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/36f858f228e3f955b9336af7f94634747c221518"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/37d5a73170579b30e67cc8b19ec69715eea3a6b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4223b33be49ee09acb6f1d26beb4a36dd3b8d63a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4867687b6ad28ab84bc0811d8f8f9972e769da02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6cd611d2abdd8623a554e14145f82c1cb4e4467a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/89e534265b62c94749639350200b10370564bb3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ab9cdf1291be551da999510b30216a2886074d7a"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/9"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-526.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4223b33be49ee09acb6f1d26beb4a36dd3b8d63a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ab9cdf1291be551da999510b30216a2886074d7a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"36f858f228e3f955b9336af7f94634747c221518","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"89e534265b62c94749639350200b10370564bb3a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6cd611d2abdd8623a554e14145f82c1cb4e4467a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"37d5a73170579b30e67cc8b19ec69715eea3a6b6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"4867687b6ad28ab84bc0811d8f8f9972e769da02","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5fb756f1bbec7a3862dda5d79028bf656271804c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5.10.274","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.15.225","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.1.192","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.6.162","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.12.116","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.18.62","status":"affected","version":"0","versionType":"semver"},{"lessThan":"7.3.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.274","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.225","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.192","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.162","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.116","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.62","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix UAF when reading statistics data\n\nThe network statistic data in the driver is protected by RCU.\nUnfortunately when tearing down the queues after an error during\nconnecting to the frontend (e.g. due to illegal Xenstore data filled\nin by the guest), the statistic data is being freed without\nsynchronizing the RCU state.  In case the data is being read via sysfs\nin this phase, access to already freed memory or memory being in new\nuse is possible.\n\nFix that by calling synchronize_net() before freeing the queue data.\n\nThis is XSA-526 / CVE-2026-100080"}],"id":"CVE-2026-100080","lastModified":"2026-11-13T15:17:28.297","metrics":{},"published":"2026-11-06T19:17:03.190","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/36f858f228e3f955b9336af7f94634747c221518"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/37d5a73170579b30e67cc8b19ec69715eea3a6b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4223b33be49ee09acb6f1d26beb4a36dd3b8d63a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4867687b6ad28ab84bc0811d8f8f9972e769da02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5fb756f1bbec7a3862dda5d79028bf656271804c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6cd611d2abdd8623a554e14145f82c1cb4e4467a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/89e534265b62c94749639350200b10370564bb3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ab9cdf1291be551da999510b30216a2886074d7a"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/9"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-526.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
diff --git a/data/2026/CVE-2026-100081.json b/data/2026/CVE-2026-100081.json
index 34b952acfb..c9696c958a 100644
--- a/data/2026/CVE-2026-100081.json
+++ b/data/2026/CVE-2026-100081.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/xen-netback/interface.c","drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"96e05a8ce243e2207704e2e7a6e7d1172730f515","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"0e786123e46d08d2247ce93a5435e45ed9f4c5d1","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"990d123d9eaa3ac6c979eed245658676d65ce0db","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"0d515c409033c8e2a645a781be3ca76ab825fc8c","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"a6bb2f1fa62c56279bdcdadce28d1310c5e12b62","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"34f0f63dc6dc11895a17bb5672451b6b11622c99","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"fb38fc58acb26d74fe8f7b19621fafaae3c040ff","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/xen-netback/interface.c","drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.11"},{"lessThan":"4.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.274","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.225","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.192","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.162","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.116","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.62","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.3","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()'s error path doesn't require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081."}],"id":"CVE-2026-100081","lastModified":"2026-11-10T17:17:17.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.1,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-11-06T19:17:03.373","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-527.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/xen-netback/interface.c","drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"96e05a8ce243e2207704e2e7a6e7d1172730f515","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"0e786123e46d08d2247ce93a5435e45ed9f4c5d1","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"990d123d9eaa3ac6c979eed245658676d65ce0db","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"0d515c409033c8e2a645a781be3ca76ab825fc8c","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"a6bb2f1fa62c56279bdcdadce28d1310c5e12b62","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"34f0f63dc6dc11895a17bb5672451b6b11622c99","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"fb38fc58acb26d74fe8f7b19621fafaae3c040ff","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"},{"lessThan":"bfddc420afe827d9f06458cdf8087cd602f8c9cb","status":"affected","version":"b17075d5c1988b83f840d272c795ac17d57ce804","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/xen-netback/interface.c","drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.11"},{"lessThan":"4.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.274","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.225","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.192","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.162","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.116","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.62","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()'s error path doesn't require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081."}],"id":"CVE-2026-100081","lastModified":"2026-11-13T15:17:28.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.1,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-11-06T19:17:03.373","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bfddc420afe827d9f06458cdf8087cd602f8c9cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-527.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
diff --git a/data/2026/CVE-2026-100082.json b/data/2026/CVE-2026-100082.json
index c0d01310a6..ebbbe49327 100644
--- a/data/2026/CVE-2026-100082.json
+++ b/data/2026/CVE-2026-100082.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/block/xen-blkback/common.h","drivers/block/xen-blkback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"253cff0526781e28b1b0f9fdacd74ecdc23d3ab7","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"2c9ccbe0ffcff3615c7ad917c49b67571a41f21c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"58ba056991dbcec8a75e6861cb4479ac947b69e6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"fe9ead8c5bdb752e329cecfecbdb5dfca5e9996b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"b764e17313534794aeb99c901869f213e36a16ef","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"c49934da934cf495faf782aa5d84f413221c9be6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"b0378161c28e77e4d0e2eda3c9433ab4394d2a2f","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5.10.274","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.15.225","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.1.192","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.6.162","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.12.116","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.18.62","status":"affected","version":"0","versionType":"semver"},{"lessThan":"7.3.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/block/xen-blkback/common.h","drivers/block/xen-blkback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.274","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.225","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.192","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.162","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.116","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.62","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.3","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-blkback: Avoid UAF when reading I/O statistics\n\nReading I/O statistics via sysfs concurrently with tearing down a\nfrontend device might result in UAF or a NULL dereference, as the\nreading of the statistics data is not synchronized with freeing the\ndata.\n\nUse a rwlock for synchronizing.\n\nThis is XSA-528 / CVE-2026-100082"}],"id":"CVE-2026-100082","lastModified":"2026-11-06T19:17:03.517","metrics":{},"published":"2026-11-06T19:17:03.517","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/253cff0526781e28b1b0f9fdacd74ecdc23d3ab7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2c9ccbe0ffcff3615c7ad917c49b67571a41f21c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/58ba056991dbcec8a75e6861cb4479ac947b69e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b0378161c28e77e4d0e2eda3c9433ab4394d2a2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b764e17313534794aeb99c901869f213e36a16ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c49934da934cf495faf782aa5d84f413221c9be6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fe9ead8c5bdb752e329cecfecbdb5dfca5e9996b"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/11"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-528.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/block/xen-blkback/common.h","drivers/block/xen-blkback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"253cff0526781e28b1b0f9fdacd74ecdc23d3ab7","status":"affected","version":"db6fbc106786f26d95889c50c18b1f28aa543a17","versionType":"git"},{"lessThan":"2c9ccbe0ffcff3615c7ad917c49b67571a41f21c","status":"affected","version":"db6fbc106786f26d95889c50c18b1f28aa543a17","versionType":"git"},{"lessThan":"58ba056991dbcec8a75e6861cb4479ac947b69e6","status":"affected","version":"db6fbc106786f26d95889c50c18b1f28aa543a17","versionType":"git"},{"lessThan":"fe9ead8c5bdb752e329cecfecbdb5dfca5e9996b","status":"affected","version":"db6fbc106786f26d95889c50c18b1f28aa543a17","versionType":"git"},{"lessThan":"b764e17313534794aeb99c901869f213e36a16ef","status":"affected","version":"db6fbc106786f26d95889c50c18b1f28aa543a17","versionType":"git"},{"lessThan":"c49934da934cf495faf782aa5d84f413221c9be6","status":"affected","version":"db6fbc106786f26d95889c50c18b1f28aa543a17","versionType":"git"},{"lessThan":"b0378161c28e77e4d0e2eda3c9433ab4394d2a2f","status":"affected","version":"db6fbc106786f26d95889c50c18b1f28aa543a17","versionType":"git"},{"lessThan":"a02926f7c89bfc798ee9514e09694ff4279928a1","status":"affected","version":"db6fbc106786f26d95889c50c18b1f28aa543a17","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/block/xen-blkback/common.h","drivers/block/xen-blkback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.274","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.225","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.192","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.162","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.116","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.62","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-blkback: Avoid UAF when reading I/O statistics\n\nReading I/O statistics via sysfs concurrently with tearing down a\nfrontend device might result in UAF or a NULL dereference, as the\nreading of the statistics data is not synchronized with freeing the\ndata.\n\nUse a rwlock for synchronizing.\n\nThis is XSA-528 / CVE-2026-100082"}],"id":"CVE-2026-100082","lastModified":"2026-11-13T15:17:28.683","metrics":{},"published":"2026-11-06T19:17:03.517","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/253cff0526781e28b1b0f9fdacd74ecdc23d3ab7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2c9ccbe0ffcff3615c7ad917c49b67571a41f21c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/58ba056991dbcec8a75e6861cb4479ac947b69e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a02926f7c89bfc798ee9514e09694ff4279928a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b0378161c28e77e4d0e2eda3c9433ab4394d2a2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b764e17313534794aeb99c901869f213e36a16ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c49934da934cf495faf782aa5d84f413221c9be6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fe9ead8c5bdb752e329cecfecbdb5dfca5e9996b"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/11"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-528.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
diff --git a/data/2026/CVE-2026-103769.json b/data/2026/CVE-2026-103769.json
new file mode 100644
index 0000000000..62e2d6c63a
--- /dev/null
+++ b/data/2026/CVE-2026-103769.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"pdf-invoices-and-packing-slips-for-woocommerce","product":"PDF Invoices and Packing Slips For WooCommerce","vendor":"Acowebs","versions":[{"changes":[{"at":"1.4.11","status":"unaffected"}],"lessThanOrEqual":"1.4.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10."}],"id":"CVE-2026-103769","lastModified":"2026-11-13T15:17:28.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:28.850","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/pdf-invoices-and-packing-slips-for-woocommerce/vulnerability/wordpress-pdf-invoices-and-packing-slips-for-woocommerce-plugin-1-4-10-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-103813.json b/data/2026/CVE-2026-103813.json
new file mode 100644
index 0000000000..a9c369c63e
--- /dev/null
+++ b/data/2026/CVE-2026-103813.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to privilege escalation to root on the appliance."}],"id":"CVE-2026-103813","lastModified":"2026-11-13T16:17:21.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T16:17:21.793","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-105427.json b/data/2026/CVE-2026-105427.json
index 83e6c49900..538859a058 100644
--- a/data/2026/CVE-2026-105427.json
+++ b/data/2026/CVE-2026-105427.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service."}],"id":"CVE-2026-105427","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:13.683","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service."}],"id":"CVE-2026-105427","lastModified":"2026-11-13T15:17:28.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:43.876602Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:13.683","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-105622.json b/data/2026/CVE-2026-105622.json
new file mode 100644
index 0000000000..98995dbbcf
--- /dev/null
+++ b/data/2026/CVE-2026-105622.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Zenitel Connect","vendor":"Zenitel","versions":[{"lessThan":"1.11.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0."}],"id":"CVE-2026-105622","lastModified":"2026-11-13T16:17:21.937","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:17:21.937","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-105623.json b/data/2026/CVE-2026-105623.json
new file mode 100644
index 0000000000..753b4ee884
--- /dev/null
+++ b/data/2026/CVE-2026-105623.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Zenitel Connect","vendor":"Zenitel","versions":[{"lessThan":"1.11.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files."}],"id":"CVE-2026-105623","lastModified":"2026-11-13T16:17:22.880","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:17:22.880","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-540"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-105624.json b/data/2026/CVE-2026-105624.json
new file mode 100644
index 0000000000..2fb11b3a15
--- /dev/null
+++ b/data/2026/CVE-2026-105624.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Zenitel Connect","vendor":"Zenitel","versions":[{"lessThan":"1.11.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected."}],"id":"CVE-2026-105624","lastModified":"2026-11-13T16:17:23.097","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:17:23.097","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-645"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-105625.json b/data/2026/CVE-2026-105625.json
new file mode 100644
index 0000000000..0a489dab93
--- /dev/null
+++ b/data/2026/CVE-2026-105625.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Zenitel Connect","vendor":"Zenitel","versions":[{"lessThan":"1.11.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source."}],"id":"CVE-2026-105625","lastModified":"2026-11-13T16:17:23.227","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:17:23.227","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1021"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-105669.json b/data/2026/CVE-2026-105669.json
index fb3d7a2b02..cd2e541e55 100644
--- a/data/2026/CVE-2026-105669.json
+++ b/data/2026/CVE-2026-105669.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3","versionType":"custom"},{"status":"unaffected","version":"10.7.4","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries."}],"id":"CVE-2026-105669","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.5,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:13.810","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3","versionType":"custom"},{"status":"unaffected","version":"10.7.4","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries."}],"id":"CVE-2026-105669","lastModified":"2026-11-13T15:17:29.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.5,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105669","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:39.429831Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:13.810","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-105671.json b/data/2026/CVE-2026-105671.json
new file mode 100644
index 0000000000..3b1bbda64a
--- /dev/null
+++ b/data/2026/CVE-2026-105671.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Zenitel Connect","vendor":"Zenitel","versions":[{"lessThan":"1.11.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests."}],"id":"CVE-2026-105671","lastModified":"2026-11-13T16:17:23.350","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:17:23.350","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-204"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107152.json b/data/2026/CVE-2026-107152.json
index 12a5c775b9..216c187fa0 100644
--- a/data/2026/CVE-2026-107152.json
+++ b/data/2026/CVE-2026-107152.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task."}],"id":"CVE-2026-107152","lastModified":"2026-11-13T00:20:06.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.680","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107152"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task."}],"id":"CVE-2026-107152","lastModified":"2026-11-13T16:17:23.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:38:13.405900Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:14.680","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107152"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107404.json b/data/2026/CVE-2026-107404.json
index c1936f0439..2e23edf735 100644
--- a/data/2026/CVE-2026-107404.json
+++ b/data/2026/CVE-2026-107404.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk."}],"id":"CVE-2026-107404","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:14.063","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk."}],"id":"CVE-2026-107404","lastModified":"2026-11-13T15:17:29.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:46.340118Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:14.063","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107522.json b/data/2026/CVE-2026-107522.json
new file mode 100644
index 0000000000..57ac0308db
--- /dev/null
+++ b/data/2026/CVE-2026-107522.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator."}],"id":"CVE-2026-107522","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T15:17:29.357","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-107523.json b/data/2026/CVE-2026-107523.json
new file mode 100644
index 0000000000..00180e05da
--- /dev/null
+++ b/data/2026/CVE-2026-107523.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service."}],"id":"CVE-2026-107523","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T15:17:29.480","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-107524.json b/data/2026/CVE-2026-107524.json
new file mode 100644
index 0000000000..bccf75e8bc
--- /dev/null
+++ b/data/2026/CVE-2026-107524.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service."}],"id":"CVE-2026-107524","lastModified":"2026-11-13T16:17:24.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:50:04.163342Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:29.607","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107525.json b/data/2026/CVE-2026-107525.json
index 905b16e5f4..23cc05ac6f 100644
--- a/data/2026/CVE-2026-107525.json
+++ b/data/2026/CVE-2026-107525.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dwll","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain service metadata useful for further attacks."}],"id":"CVE-2026-107525","lastModified":"2026-11-13T13:17:40.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:17:40.347","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dwll","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain service metadata useful for further attacks."}],"id":"CVE-2026-107525","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:17:40.347","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-107526.json b/data/2026/CVE-2026-107526.json
index 2ca3dcc2f3..18b161a9e4 100644
--- a/data/2026/CVE-2026-107526.json
+++ b/data/2026/CVE-2026-107526.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exploit this vulnerability, potentially leading to stored cross-site scripting in the management interface."}],"id":"CVE-2026-107526","lastModified":"2026-11-13T13:17:40.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:17:40.483","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exploit this vulnerability, potentially leading to stored cross-site scripting in the management interface."}],"id":"CVE-2026-107526","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:17:40.483","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-109091.json b/data/2026/CVE-2026-109091.json
new file mode 100644
index 0000000000..3ebc0d5648
--- /dev/null
+++ b/data/2026/CVE-2026-109091.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote."}],"id":"CVE-2026-109091","lastModified":"2026-11-13T16:17:25.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T16:17:25.453","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/56e4ab6e8d94222480c8d7a28f530334059e3ab7"},{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/d88f0f7fdb2834c24feca63c0af5f46a57f4a04c"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"meissner@suse.de","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-109092.json b/data/2026/CVE-2026-109092.json
new file mode 100644
index 0000000000..7bf5e8877f
--- /dev/null
+++ b/data/2026/CVE-2026-109092.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code."}],"id":"CVE-2026-109092","lastModified":"2026-11-13T15:17:29.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T15:17:29.740","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/a4d7800f0f56469a082e3755bfa6b148c707075c"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"meissner@suse.de","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-109093.json b/data/2026/CVE-2026-109093.json
new file mode 100644
index 0000000000..42c034f16d
--- /dev/null
+++ b/data/2026/CVE-2026-109093.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack buffer overflow in  ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server."}],"id":"CVE-2026-109093","lastModified":"2026-11-13T15:17:29.977","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T15:17:29.873","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/99ce069ae814b39048543062e073320f14723ee0"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"meissner@suse.de","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-109094.json b/data/2026/CVE-2026-109094.json
new file mode 100644
index 0000000000..3cd510a52c
--- /dev/null
+++ b/data/2026/CVE-2026-109094.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server."}],"id":"CVE-2026-109094","lastModified":"2026-11-13T15:17:30.110","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T15:17:30.017","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/a59678e491a762e504829cac069cf37f4ccafe0d"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"meissner@suse.de","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-109097.json b/data/2026/CVE-2026-109097.json
index 2b1867a915..5e94300162 100644
--- a/data/2026/CVE-2026-109097.json
+++ b/data/2026/CVE-2026-109097.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"ROS#","vendor":"Siemens","versions":[{"lessThan":"V2.3.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program."}],"id":"CVE-2026-109097","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.223","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-435267.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"productcert@siemens.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"ROS#","vendor":"Siemens","versions":[{"lessThan":"V2.3.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program."}],"id":"CVE-2026-109097","lastModified":"2026-11-13T15:17:30.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109097","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:09:59.876452Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.223","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-435267.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"productcert@siemens.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-109445.json b/data/2026/CVE-2026-109445.json
new file mode 100644
index 0000000000..e6d3679b06
--- /dev/null
+++ b/data/2026/CVE-2026-109445.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PLANET GS-5220-8P2T2S","vendor":"PLANET Technology Corp.","versions":[{"lessThan":"3.2412b261008","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstax_auth HTTP Cookie value that is copied into a fixed-size stack buffer without length validation. Attackers can send a crafted unauthenticated HTTP request with an oversized cookie to overwrite the saved return address and corrupt stack memory, leading to memory corruption and potential denial of service on the device."}],"id":"CVE-2026-109445","lastModified":"2026-11-13T15:17:30.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T15:17:30.290","references":[{"source":"disclosure@vulncheck.com","url":"https://www.planet.com.tw/en/support/security-advisory/12"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/planet-gs-5220-8p2t2s-stack-buffer-overflow-via-webstax-auth-cookie"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-109904.json b/data/2026/CVE-2026-109904.json
index 06a88f5efa..9cf9597d3f 100644
--- a/data/2026/CVE-2026-109904.json
+++ b/data/2026/CVE-2026-109904.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information."}],"id":"CVE-2026-109904","lastModified":"2026-11-13T11:17:15.783","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T11:17:15.677","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/ff754b812597177412f2e2fa2b1dd1eecbeb75cf"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"meissner@suse.de","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information."}],"id":"CVE-2026-109904","lastModified":"2026-11-13T16:17:25.600","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T11:17:15.677","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/a3899d75e180d73f2971af2a402e6fdf19c0339c"},{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/ff754b812597177412f2e2fa2b1dd1eecbeb75cf"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"meissner@suse.de","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-110091.json b/data/2026/CVE-2026-110091.json
index 7686738541..0869d1fe2f 100644
--- a/data/2026/CVE-2026-110091.json
+++ b/data/2026/CVE-2026-110091.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Premiere","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Premiere","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Premiere Pro is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-110091","lastModified":"2026-11-10T22:04:19.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":4.0,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T21:18:20.427","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Premiere","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Premiere","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Premiere Pro is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-110091","lastModified":"2026-11-13T16:17:25.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":4.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110091","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:52:15.152511Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:20.427","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-111545.json b/data/2026/CVE-2026-111545.json
new file mode 100644
index 0000000000..f292a21a49
--- /dev/null
+++ b/data/2026/CVE-2026-111545.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted certificates."}],"id":"CVE-2026-111545","lastModified":"2026-11-13T16:17:26.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:45:58.779622Z","version":"2.0.3"}}]},"published":"2026-11-13T16:17:26.740","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-111547.json b/data/2026/CVE-2026-111547.json
new file mode 100644
index 0000000000..283953f97d
--- /dev/null
+++ b/data/2026/CVE-2026-111547.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure."}],"id":"CVE-2026-111547","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T15:17:30.450","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-112306.json b/data/2026/CVE-2026-112306.json
index 5df310fde0..6c48c25731 100644
--- a/data/2026/CVE-2026-112306.json
+++ b/data/2026/CVE-2026-112306.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/nocobase/nocobase","defaultStatus":"unaffected","product":"nocobase","repo":"https://github.com/nocobase/nocobase","vendor":"nocobase","versions":[{"lessThanOrEqual":"2.2.28","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file."}],"id":"CVE-2026-112306","lastModified":"2026-10-19T17:17:15.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112306","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-19T15:59:02.659152Z","version":"2.0.3"}}]},"published":"2026-10-19T16:17:06.570","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocobase/nocobase"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocobase/nocobase/blob/v2.2.28/packages/plugins/@nocobase/plugin-collection-sql/src/server/resources/sql.ts#L14-L104"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocobase/nocobase/issues/10629"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocobase-plugin-collection-sql-through-2.2.28-sql-injection-via-sqlcollection-setfields"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/nocobase/nocobase","defaultStatus":"unaffected","product":"nocobase","repo":"https://github.com/nocobase/nocobase","vendor":"nocobase","versions":[{"lessThanOrEqual":"2.2.46","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoBase @nocobase/plugin-collection-sql through 2.2.46 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file."}],"id":"CVE-2026-112306","lastModified":"2026-11-13T15:17:30.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112306","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-19T15:59:02.659152Z","version":"2.0.3"}}]},"published":"2026-10-19T16:17:06.570","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocobase/nocobase"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocobase/nocobase/blob/v2.2.28/packages/plugins/@nocobase/plugin-collection-sql/src/server/resources/sql.ts#L14-L104"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocobase/nocobase/issues/10629"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocobase-plugin-collection-sql-through-2.2.28-sql-injection-via-sqlcollection-setfields"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113560.json b/data/2026/CVE-2026-113560.json
index 4a755b2b49..b782f5c8b7 100644
--- a/data/2026/CVE-2026-113560.json
+++ b/data/2026/CVE-2026-113560.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113560","lastModified":"2026-11-10T22:18:21.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:13:40.305625Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.823","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113560","lastModified":"2026-11-13T16:13:27.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:13:40.305625Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.823","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113562.json b/data/2026/CVE-2026-113562.json
index 9a82f0778b..62587538ce 100644
--- a/data/2026/CVE-2026-113562.json
+++ b/data/2026/CVE-2026-113562.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113562","lastModified":"2026-11-11T11:17:12.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:49.151746Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.980","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113562","lastModified":"2026-11-13T16:10:15.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:49.151746Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.980","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113563.json b/data/2026/CVE-2026-113563.json
index 241088bbe8..8eda820f1c 100644
--- a/data/2026/CVE-2026-113563.json
+++ b/data/2026/CVE-2026-113563.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113563","lastModified":"2026-11-11T05:19:24.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:50.270","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-657"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113563","lastModified":"2026-11-13T16:05:02.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:50.270","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-657"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113565.json b/data/2026/CVE-2026-113565.json
index 75e9f49d70..2f3d62d407 100644
--- a/data/2026/CVE-2026-113565.json
+++ b/data/2026/CVE-2026-113565.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113565","lastModified":"2026-11-11T05:19:24.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113565","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:50.423","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113565","lastModified":"2026-11-13T16:03:42.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113565","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:50.423","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113567.json b/data/2026/CVE-2026-113567.json
index f59d95795e..c37fc16b30 100644
--- a/data/2026/CVE-2026-113567.json
+++ b/data/2026/CVE-2026-113567.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113567","lastModified":"2026-11-11T05:19:25.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:50.580","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113567","lastModified":"2026-11-13T16:02:19.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:50.580","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-114406.json b/data/2026/CVE-2026-114406.json
index 7344bbec29..5f3ff666c3 100644
--- a/data/2026/CVE-2026-114406.json
+++ b/data/2026/CVE-2026-114406.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-100.3.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-100.3.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-60.3.el6_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"nss","product":"Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.44.0-15.el6_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-70.3.el7_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-81.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.4::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.12::el8"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202610250235-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"413.92.202611041925-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"414.92.202610242240-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"416.94.202610242150-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"417.94.202611061051-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"418.94.202610242013-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.19.9.6.202610241701-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202610242033-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202610241345-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.22.9.8.202610241758-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:13::el7"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 13.0 - ELS","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.8.33-2.el7ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.2::el8"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 16.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.119-4.el8ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1::el9"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 17.1 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.20.68-2.el9ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0::el9"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Services on OpenShift 18.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.27.89-3.el9ost","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/service-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-cli-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-kube-adaptor-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-network-observer-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-network-observer-rhel9-operator","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-router-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"3.5.3-3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-system-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9"],"defaultStatus":"affected","packageName":"agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9","product":"agentic cluster security suite 0.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793102187","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management:4::el9"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-metrics-rhel9-operator","product":"Cost Management 4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793202662","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.11::el9"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-central-db-rhel9","product":"Red Hat Advanced Cluster Security for Kubernetes 4.11","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793745312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.10::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-central-db-rhel8","product":"Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793184257","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793961846","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793962303","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793961309","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398074","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cpu-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398071","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794418334","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398147","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398157","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cpu-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444554","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444456","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444339","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444409","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-gaudi-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444510","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444600","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-ui-rhel10","product":"Red Hat Cost Management On-Premise 1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793825318","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-server-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793734080","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-ui-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793733716","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/disk-image-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793995863","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-aws-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-azure-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-azure-rocm-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793914518","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gcp-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-rocm-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793914504","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"ca-certificates-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2026.2.92_v9.0.319-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041986","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042072","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042067","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041987","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793329709","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793328358","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042145","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042011","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042086","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042088","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-6.4-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041995","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042074","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042008","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793326837","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042010","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042162","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042004","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rubin-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042092","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042117","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042114","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.14-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042024","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042008","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793327660","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/guidellm-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793719302","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793869589","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-payload-processing-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759494","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-automl-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763148","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-autorag-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761178","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-built-in-detector-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793402315","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-cli-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757717","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761673","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757463","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758906","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761044","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756253","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-eval-hub-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760703","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feast-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793755520","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feast-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793630340","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feature-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758949","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-fms-guardrails-orchestrator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793765218","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-guardrails-detector-huggingface-runtime-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793403223","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757743","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-agent-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793766233","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-autogluon-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776192","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764826","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759522","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-localmodel-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793768650","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-localmodelnode-agent-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761860","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793867964","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-router-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761723","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-storage-initializer-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691340","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kube-auth-proxy-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793770093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793602161","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756370","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-latency-predictor-prediction-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793646667","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-latency-predictor-training-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793767642","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-async-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760437","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-apiserver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760171","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-gc-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761642","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764510","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-processor-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759957","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-router-disagg-sidecar-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756751","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-router-endpoint-picker-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756521","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-maas-api-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793762624","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793766456","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763734","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793584398","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlmd-grpc-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793607972","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-api-server-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793765658","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-driver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763787","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-launcher-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759883","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758891","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763216","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlserver-cuda-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760043","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlserver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793762133","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758732","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758836","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757264","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758686","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759162","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757908","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758359","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763697","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759904","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-metadata-collection-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793298535","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-performance-data-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793300494","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-job-async-upload-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793799006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776221","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793798983","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763721","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-must-gather-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793770107","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760033","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-core-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793383222","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761401","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764752","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-openvino-model-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793455001","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793679560","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-pipelines-components-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764886","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhaii-cluster-validator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776868","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhaii-validator-tools-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776772","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhel9-operator","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793872681","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-spark-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778378","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ta-lmes-driver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776034","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ta-lmes-job-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793398367","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-cpu-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793688471","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793715343","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-rocm-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793680216","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trainer-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793775975","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda128-torch28-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763288","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda128-torch29-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763316","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793777468","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch28-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763250","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch29-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763220","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793497091","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-nemo-guardrails-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793369260","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778341","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-service-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793777246","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793381112","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778341","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685856","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793677376","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workload-variant-autoscaler-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793606223","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/rhai-cli-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757717","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-controller-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792840135","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-git-cloner-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835365","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-bundler-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835298","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-processing-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792836805","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-rhel9-operator","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792844269","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837466","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-webhook-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792838794","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-waiters-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837567","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-webhook-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792851895","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-controller-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837598","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-git-cloner-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837398","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-bundler-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792838765","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-processing-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835879","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-rhel10-operator","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792859629","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792857112","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-webhook-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792840655","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-waiters-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792839475","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-webhook-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835571","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el10"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793043152","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/code-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793055196","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/code-sshd-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793053893","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/configbump-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033767","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/dashboard-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793040801","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/devspaces-rhel9-operator","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033165","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/imagepuller-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793036189","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/jetbrains-ide-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793036500","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/multicluster-redirector-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793037970","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/oauth2-proxy-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793034989","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/openvsx-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793038501","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/pluginregistry-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793050419","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/server-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041480","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033496","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041345","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793120195","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:windows_machine_config:11.0::el9"],"defaultStatus":"affected","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 11.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793279001","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686180","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682120","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685934","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685630","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685815","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682423","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682753","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682099","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685996","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682096","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691592","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692526","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691769","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692411","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691749","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691990","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691538","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692079","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691784","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691455","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684635","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684783","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686869","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-promoter-extension-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685916","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685284","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684716","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-4-18-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686175","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685138","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685777","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-promoter-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684735","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685586","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685190","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684655","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-kubernetes-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005764","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/haproxy-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793004999","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793004989","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005812","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-cpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-gaudi-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-neuron-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-omni-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-rocm-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-spyre-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii/vllm-neuron-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhdh:1"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhdh:2"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gaudi-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cpu-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cuda-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-rocm-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-spyre-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-torch-2.14-cpu-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-torch-2.14-cuda-13.0-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai-early-access/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhai-early-access/docling-sdk-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhai-early-access/docling-serve-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-payload-processing-e2e-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-authbridge-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-caikit-nlp-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-caikit-tgis-serving-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-codeflare-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kueue-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llama-stack-core-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-inference-scheduler-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-kv-cache-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-routing-sidecar-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mcp-lifecycle-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mcp-lifecycle-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-runtime-generic-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mm-rest-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-runtime-adapter-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-serving-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-cpu-torch210-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-th06-cpu-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda121-torch24-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda124-torch25-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm62-torch24-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm62-torch25-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-gaudi-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-rocm-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed."}],"id":"CVE-2026-114406","lastModified":"2026-11-13T13:17:48.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T20:11:04.886053Z","version":"2.0.3"}}]},"published":"2026-10-21T21:17:58.547","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:86595"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88455"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88550"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88560"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88562"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88563"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88564"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88662"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88668"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88669"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88779"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89081"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89131"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89197"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89333"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89651"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89714"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89725"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89838"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89907"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90272"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90969"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90985"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91202"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91204"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91206"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91207"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91217"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91218"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91219"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91224"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91233"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91234"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91235"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91236"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91237"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91238"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91241"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91242"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91243"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91244"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91245"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91246"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91248"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91249"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91997"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:92006"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:92342"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93043"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93044"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93045"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93046"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94468"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94474"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94476"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94562"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94583"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94584"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94631"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94702"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94709"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94717"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94721"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94738"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94802"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95058"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95090"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95264"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95365"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95745"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95872"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96282"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96323"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96333"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96400"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96403"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96406"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99787"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99792"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99794"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99796"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99800"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114406"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556046"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-100.3.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-100.3.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-60.3.el6_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"nss","product":"Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.44.0-15.el6_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-70.3.el7_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-81.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.4::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.12::el8"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202610250235-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"413.92.202611041925-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"414.92.202610242240-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"416.94.202610242150-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"417.94.202611061051-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"418.94.202610242013-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.19.9.6.202610241701-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202610242033-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202610241345-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.22.9.8.202610241758-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:13::el7"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 13.0 - ELS","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.8.33-2.el7ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.2::el8"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 16.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.119-4.el8ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1::el9"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 17.1 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.20.68-2.el9ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0::el9"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Services on OpenShift 18.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.27.89-3.el9ost","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/service-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-cli-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-kube-adaptor-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-network-observer-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-network-observer-rhel9-operator","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-router-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"3.5.3-3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-system-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9"],"defaultStatus":"affected","packageName":"agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9","product":"agentic cluster security suite 0.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793102187","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management:4::el9"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-metrics-rhel9-operator","product":"Cost Management 4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793202662","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.11::el9"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-central-db-rhel9","product":"Red Hat Advanced Cluster Security for Kubernetes 4.11","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793745312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.10::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-central-db-rhel8","product":"Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793184257","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793961846","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793962303","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793961309","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398074","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cpu-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398071","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794418334","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398147","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398157","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cpu-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444554","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444456","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444339","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444409","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-gaudi-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444510","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444600","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-ui-rhel10","product":"Red Hat Cost Management On-Premise 1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793825318","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhdh:1.10::el9"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 1.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794341043","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhdh:2.1::el10"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel10","product":"Red Hat Developer Hub 2.1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794002463","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-server-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793734080","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-ui-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793733716","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/disk-image-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793995863","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-aws-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-azure-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-azure-rocm-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793914518","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gcp-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-rocm-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793914504","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"ca-certificates-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2026.2.92_v9.0.319-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041986","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042072","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042067","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041987","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793329709","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793328358","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042145","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042011","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042086","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042088","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-6.4-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041995","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042074","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042008","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793326837","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042010","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042162","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042004","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rubin-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042092","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042117","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042114","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.14-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042024","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042008","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793327660","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/guidellm-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793719302","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793869589","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-payload-processing-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759494","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-automl-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763148","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-autorag-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761178","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-built-in-detector-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793402315","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-cli-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757717","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761673","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757463","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758906","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761044","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756253","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-eval-hub-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760703","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feast-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793755520","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feast-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793630340","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feature-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758949","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-fms-guardrails-orchestrator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793765218","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-guardrails-detector-huggingface-runtime-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793403223","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757743","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-agent-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793766233","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-autogluon-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776192","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764826","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759522","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-localmodel-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793768650","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-localmodelnode-agent-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761860","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793867964","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-router-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761723","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-storage-initializer-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691340","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kube-auth-proxy-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793770093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793602161","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756370","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-latency-predictor-prediction-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793646667","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-latency-predictor-training-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793767642","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-async-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760437","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-apiserver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760171","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-gc-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761642","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764510","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-processor-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759957","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-router-disagg-sidecar-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756751","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-router-endpoint-picker-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756521","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-maas-api-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793762624","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793766456","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763734","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793584398","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlmd-grpc-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793607972","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-api-server-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793765658","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-driver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763787","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-launcher-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759883","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758891","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763216","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlserver-cuda-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760043","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlserver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793762133","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758732","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758836","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757264","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758686","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759162","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757908","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758359","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763697","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759904","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-metadata-collection-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793298535","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-performance-data-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793300494","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-job-async-upload-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793799006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776221","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793798983","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763721","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-must-gather-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793770107","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760033","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-core-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793383222","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761401","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764752","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-openvino-model-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793455001","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793679560","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-pipelines-components-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764886","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhaii-cluster-validator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776868","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhaii-validator-tools-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776772","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhel9-operator","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793872681","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-spark-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778378","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ta-lmes-driver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776034","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ta-lmes-job-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793398367","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-cpu-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793688471","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793715343","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-rocm-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793680216","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trainer-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793775975","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda128-torch28-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763288","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda128-torch29-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763316","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793777468","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch28-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763250","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch29-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763220","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793497091","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-nemo-guardrails-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793369260","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778341","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-service-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793777246","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793381112","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778341","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685856","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793677376","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workload-variant-autoscaler-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793606223","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/rhai-cli-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757717","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-controller-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792840135","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-git-cloner-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835365","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-bundler-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835298","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-processing-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792836805","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-rhel9-operator","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792844269","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837466","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-webhook-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792838794","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-waiters-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837567","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-webhook-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792851895","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-controller-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837598","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-git-cloner-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837398","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-bundler-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792838765","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-processing-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835879","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-rhel10-operator","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792859629","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792857112","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-webhook-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792840655","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-waiters-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792839475","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-webhook-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835571","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el10"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793043152","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/code-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793055196","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/code-sshd-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793053893","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/configbump-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033767","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/dashboard-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793040801","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/devspaces-rhel9-operator","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033165","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/imagepuller-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793036189","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/jetbrains-ide-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793036500","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/multicluster-redirector-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793037970","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/oauth2-proxy-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793034989","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/openvsx-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793038501","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/pluginregistry-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793050419","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/server-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041480","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033496","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041345","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793120195","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:windows_machine_config:11.0::el9"],"defaultStatus":"affected","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 11.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793279001","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686180","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682120","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685934","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685630","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685815","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682423","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682753","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682099","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685996","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682096","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691592","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692526","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691769","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692411","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691749","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691990","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691538","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692079","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691784","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691455","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684635","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684783","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686869","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-promoter-extension-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685916","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685284","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684716","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-4-18-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686175","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685138","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685777","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-promoter-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684735","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685586","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685190","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684655","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-kubernetes-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005764","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/haproxy-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793004999","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793004989","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005812","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-cpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-gaudi-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-neuron-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-omni-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-rocm-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-spyre-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii/vllm-neuron-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhdh:2"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gaudi-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cpu-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cuda-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-rocm-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-spyre-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-torch-2.14-cpu-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-torch-2.14-cuda-13.0-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai-early-access/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhai-early-access/docling-sdk-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhai-early-access/docling-serve-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-payload-processing-e2e-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-authbridge-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-caikit-nlp-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-caikit-tgis-serving-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-codeflare-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kueue-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llama-stack-core-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-inference-scheduler-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-kv-cache-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-routing-sidecar-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mcp-lifecycle-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mcp-lifecycle-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-runtime-generic-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mm-rest-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-runtime-adapter-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-serving-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-cpu-torch210-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-th06-cpu-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda121-torch24-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda124-torch25-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm62-torch24-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm62-torch25-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-gaudi-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-rocm-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed."}],"id":"CVE-2026-114406","lastModified":"2026-11-13T15:17:30.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T20:11:04.886053Z","version":"2.0.3"}}]},"published":"2026-10-21T21:17:58.547","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:86595"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88455"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88550"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88560"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88562"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88563"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88564"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88662"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88668"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88669"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88779"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89081"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89131"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89197"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89333"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89651"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89714"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89725"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89838"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89907"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90272"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90969"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90985"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91202"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91204"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91206"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91207"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91217"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91218"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91219"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91224"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91233"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91234"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91235"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91236"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91237"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91238"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91241"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91242"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91243"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91244"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91245"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91246"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91248"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91249"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91997"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:92006"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:92342"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93043"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93044"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93045"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93046"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94468"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94474"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94476"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94562"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94583"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94584"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94631"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94702"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94709"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94717"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94721"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94738"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94802"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95058"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95090"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95264"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95365"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95745"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95872"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96282"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96323"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96333"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96391"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96400"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96403"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96406"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99044"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99787"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99792"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99794"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99796"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99800"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114406"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556046"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116059.json b/data/2026/CVE-2026-116059.json
index f81a07b0cf..2905cb91ff 100644
--- a/data/2026/CVE-2026-116059.json
+++ b/data/2026/CVE-2026-116059.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"LetsRecover","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The LetsRecover  WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action."}],"id":"CVE-2026-116059","lastModified":"2026-11-13T06:16:52.700","metrics":{},"published":"2026-11-13T06:16:52.700","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"LetsRecover","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The LetsRecover  WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action."}],"id":"CVE-2026-116059","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:52.700","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-116411.json b/data/2026/CVE-2026-116411.json
index 0a21543bf6..75608b167e 100644
--- a/data/2026/CVE-2026-116411.json
+++ b/data/2026/CVE-2026-116411.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to information disclosure via requests to internal services."}],"id":"CVE-2026-116411","lastModified":"2026-11-13T14:17:48.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:17:48.130","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to information disclosure via requests to internal services."}],"id":"CVE-2026-116411","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:17:48.130","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116412.json b/data/2026/CVE-2026-116412.json
index 8f193e45a9..b8e98e0fb8 100644
--- a/data/2026/CVE-2026-116412.json
+++ b/data/2026/CVE-2026-116412.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an insecure-file-permissions vulnerability. A local low-privileged attacker could exploit this vulnerability to disclose administrative credentials."}],"id":"CVE-2026-116412","lastModified":"2026-11-13T14:17:48.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:17:48.263","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an insecure-file-permissions vulnerability. A local low-privileged attacker could exploit this vulnerability to disclose administrative credentials."}],"id":"CVE-2026-116412","lastModified":"2026-11-13T16:17:27.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116412","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:31:02.106080Z","version":"2.0.3"}}]},"published":"2026-11-13T14:17:48.263","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116413.json b/data/2026/CVE-2026-116413.json
index 9e0474721b..dfdcf63f05 100644
--- a/data/2026/CVE-2026-116413.json
+++ b/data/2026/CVE-2026-116413.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized access."}],"id":"CVE-2026-116413","lastModified":"2026-11-13T14:17:48.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:17:48.390","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized access."}],"id":"CVE-2026-116413","lastModified":"2026-11-13T16:17:28.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:44:47.828120Z","version":"2.0.3"}}]},"published":"2026-11-13T14:17:48.390","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116417.json b/data/2026/CVE-2026-116417.json
index f4ab7168ec..6b9c6588ec 100644
--- a/data/2026/CVE-2026-116417.json
+++ b/data/2026/CVE-2026-116417.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access."}],"id":"CVE-2026-116417","lastModified":"2026-11-13T09:17:32.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.160","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-521"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access."}],"id":"CVE-2026-116417","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.160","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-521"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116418.json b/data/2026/CVE-2026-116418.json
index dcbd8d18a4..df70cb57cb 100644
--- a/data/2026/CVE-2026-116418.json
+++ b/data/2026/CVE-2026-116418.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116418","lastModified":"2026-11-13T10:17:25.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:17:25.253","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116418","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:17:25.253","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116419.json b/data/2026/CVE-2026-116419.json
index 5f4694d924..90338f0a34 100644
--- a/data/2026/CVE-2026-116419.json
+++ b/data/2026/CVE-2026-116419.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116419","lastModified":"2026-11-13T09:17:32.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.290","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116419","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.290","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116420.json b/data/2026/CVE-2026-116420.json
index e59dc56684..c30b653bb5 100644
--- a/data/2026/CVE-2026-116420.json
+++ b/data/2026/CVE-2026-116420.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116420","lastModified":"2026-11-13T09:17:32.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.420","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116420","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.420","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116421.json b/data/2026/CVE-2026-116421.json
index b19972973d..c7cdcbd42a 100644
--- a/data/2026/CVE-2026-116421.json
+++ b/data/2026/CVE-2026-116421.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116421","lastModified":"2026-11-13T09:17:32.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.540","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116421","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.540","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116422.json b/data/2026/CVE-2026-116422.json
index 1d690006ca..e27ce78e19 100644
--- a/data/2026/CVE-2026-116422.json
+++ b/data/2026/CVE-2026-116422.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information exposure."}],"id":"CVE-2026-116422","lastModified":"2026-11-13T09:17:32.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.670","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information exposure."}],"id":"CVE-2026-116422","lastModified":"2026-11-13T16:17:29.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116422","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:52:16.242187Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:32.670","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116423.json b/data/2026/CVE-2026-116423.json
index 5be7186285..489c5160ba 100644
--- a/data/2026/CVE-2026-116423.json
+++ b/data/2026/CVE-2026-116423.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Improper Verification of Cryptographic Signature vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Information tampering."}],"id":"CVE-2026-116423","lastModified":"2026-11-13T09:17:32.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.797","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Improper Verification of Cryptographic Signature vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Information tampering."}],"id":"CVE-2026-116423","lastModified":"2026-11-13T16:17:30.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:55:07.617587Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:32.797","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116424.json b/data/2026/CVE-2026-116424.json
index fc828c9f3c..956baed304 100644
--- a/data/2026/CVE-2026-116424.json
+++ b/data/2026/CVE-2026-116424.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains Unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116424","lastModified":"2026-11-13T09:17:32.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.920","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains Unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116424","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.920","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116425.json b/data/2026/CVE-2026-116425.json
index 53f1527a99..53fe548b10 100644
--- a/data/2026/CVE-2026-116425.json
+++ b/data/2026/CVE-2026-116425.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116425","lastModified":"2026-11-13T09:17:33.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.053","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116425","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.053","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116426.json b/data/2026/CVE-2026-116426.json
index 191adf4a54..7f9efac8f3 100644
--- a/data/2026/CVE-2026-116426.json
+++ b/data/2026/CVE-2026-116426.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-116426","lastModified":"2026-11-13T09:17:33.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.173","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-116426","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.173","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116427.json b/data/2026/CVE-2026-116427.json
index 73be110e89..d322dd797c 100644
--- a/data/2026/CVE-2026-116427.json
+++ b/data/2026/CVE-2026-116427.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116427","lastModified":"2026-11-13T09:17:33.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.297","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116427","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.297","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116430.json b/data/2026/CVE-2026-116430.json
index b7d366c560..0e6673f650 100644
--- a/data/2026/CVE-2026-116430.json
+++ b/data/2026/CVE-2026-116430.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Version 6.4.0, contain an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering."}],"id":"CVE-2026-116430","lastModified":"2026-11-13T09:17:33.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.427","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Version 6.4.0, contain an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering."}],"id":"CVE-2026-116430","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.427","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116431.json b/data/2026/CVE-2026-116431.json
index d283296c55..434c24bd83 100644
--- a/data/2026/CVE-2026-116431.json
+++ b/data/2026/CVE-2026-116431.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116431","lastModified":"2026-11-13T09:17:33.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.557","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116431","lastModified":"2026-11-13T16:17:31.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116431","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:56:07.662146Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:33.557","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116432.json b/data/2026/CVE-2026-116432.json
index 8840206a1a..634a14fca9 100644
--- a/data/2026/CVE-2026-116432.json
+++ b/data/2026/CVE-2026-116432.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116432","lastModified":"2026-11-13T08:17:16.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T08:17:16.467","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116432","lastModified":"2026-11-13T16:17:32.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:53:38.654948Z","version":"2.0.3"}}]},"published":"2026-11-13T08:17:16.467","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116433.json b/data/2026/CVE-2026-116433.json
index 62bc311793..f443655f43 100644
--- a/data/2026/CVE-2026-116433.json
+++ b/data/2026/CVE-2026-116433.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"id":"CVE-2026-116433","lastModified":"2026-11-13T10:17:25.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:17:25.507","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"id":"CVE-2026-116433","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:17:25.507","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116436.json b/data/2026/CVE-2026-116436.json
index e659715e47..f7b0c1ec76 100644
--- a/data/2026/CVE-2026-116436.json
+++ b/data/2026/CVE-2026-116436.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"id":"CVE-2026-116436","lastModified":"2026-11-13T09:17:33.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.680","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"id":"CVE-2026-116436","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.680","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116438.json b/data/2026/CVE-2026-116438.json
index 0a46a556b8..96debe0cfb 100644
--- a/data/2026/CVE-2026-116438.json
+++ b/data/2026/CVE-2026-116438.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0 , contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service."}],"id":"CVE-2026-116438","lastModified":"2026-11-13T09:17:33.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.807","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0 , contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service."}],"id":"CVE-2026-116438","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.807","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116453.json b/data/2026/CVE-2026-116453.json
index 937dfa674b..20e98dbbbe 100644
--- a/data/2026/CVE-2026-116453.json
+++ b/data/2026/CVE-2026-116453.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116453","lastModified":"2026-11-13T09:17:33.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.930","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116453","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.930","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116509.json b/data/2026/CVE-2026-116509.json
index 5f323a80ab..e96c2cda5b 100644
--- a/data/2026/CVE-2026-116509.json
+++ b/data/2026/CVE-2026-116509.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker","vendor":"expresstech","versions":[{"lessThanOrEqual":"11.2.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call."}],"id":"CVE-2026-116509","lastModified":"2026-11-13T10:17:25.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:25.623","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/functions.php#L1135"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1187"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1193"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1209"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/classes/class-qmn-quiz-manager.php#L688"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3779826%40quiz-master-next&new=3779826%40quiz-master-next"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker","vendor":"expresstech","versions":[{"lessThanOrEqual":"11.2.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call."}],"id":"CVE-2026-116509","lastModified":"2026-11-13T16:17:33.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116509","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:58.546107Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:25.623","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/functions.php#L1135"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1187"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1193"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1209"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/classes/class-qmn-quiz-manager.php#L688"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3779826%40quiz-master-next&new=3779826%40quiz-master-next"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118063.json b/data/2026/CVE-2026-118063.json
index fdd4fc6e4e..ec211dcfa4 100644
--- a/data/2026/CVE-2026-118063.json
+++ b/data/2026/CVE-2026-118063.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Advance Guest Post","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration."}],"id":"CVE-2026-118063","lastModified":"2026-11-13T06:16:52.807","metrics":{},"published":"2026-11-13T06:16:52.807","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/45ea832a-9ed9-4f75-bc84-1b09794d362a/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Advance Guest Post","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachable directory, which can lead to remote code execution depending on the server configuration."}],"id":"CVE-2026-118063","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:52.807","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/45ea832a-9ed9-4f75-bc84-1b09794d362a/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-118064.json b/data/2026/CVE-2026-118064.json
index 6ad1bbe313..835e76da68 100644
--- a/data/2026/CVE-2026-118064.json
+++ b/data/2026/CVE-2026-118064.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Advance Guest Post","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely.\n\nSuccessful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written."}],"id":"CVE-2026-118064","lastModified":"2026-11-13T06:16:52.897","metrics":{},"published":"2026-11-13T06:16:52.897","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/897a812b-b84b-4422-9f3b-20402a0a8af5/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Advance Guest Post","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute code remotely.\n\nSuccessful exploitation additionally requires the target to run PHP 7.x; on PHP 8.0 and later the vulnerable code path raises a fatal error before the file is written."}],"id":"CVE-2026-118064","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:52.897","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/897a812b-b84b-4422-9f3b-20402a0a8af5/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-118065.json b/data/2026/CVE-2026-118065.json
index 4a22f9efec..f88390b158 100644
--- a/data/2026/CVE-2026-118065.json
+++ b/data/2026/CVE-2026-118065.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Advance Guest Post","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files."}],"id":"CVE-2026-118065","lastModified":"2026-11-13T06:16:52.997","metrics":{},"published":"2026-11-13T06:16:52.997","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/77771b0e-a3e7-4dd6-b5b4-c179c6db1deb/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Advance Guest Post","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files."}],"id":"CVE-2026-118065","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:52.997","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/77771b0e-a3e7-4dd6-b5b4-c179c6db1deb/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-118383.json b/data/2026/CVE-2026-118383.json
index 509f6c73a2..845a389430 100644
--- a/data/2026/CVE-2026-118383.json
+++ b/data/2026/CVE-2026-118383.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MongoDB Server","vendor":"MongoDB","versions":[{"lessThan":"9.0.7","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThan":"8.3.16","status":"affected","version":"8.3.0","versionType":"semver"},{"lessThan":"8.0.37","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThan":"7.0.48","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"6.0.30","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThan":"5.0.35","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"4.4.32","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not."}],"id":"CVE-2026-118383","lastModified":"2026-11-10T22:08:59.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.5,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-10T21:18:58.980","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/SERVER-138119"},{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/SERVER-138175"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"cna@mongodb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MongoDB Server","vendor":"MongoDB","versions":[{"lessThan":"9.0.7","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThan":"8.3.16","status":"affected","version":"8.3.0","versionType":"semver"},{"lessThan":"8.0.37","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThan":"7.0.48","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"6.0.30","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThan":"5.0.35","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"4.4.32","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"EF754CF5-9B4F-44F0-92B2-CC54454FD85F","versionEndExcluding":"4.4.32","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"C2C6876E-42EA-4A3D-B1C7-1E82ED660406","versionEndExcluding":"5.0.35","versionStartIncluding":"5.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"7C728B1A-4D8E-436E-9285-05BBF5C2B7CD","versionEndExcluding":"6.0.30","versionStartIncluding":"6.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"8528B753-379A-4E20-A5CF-99CA18D2BE71","versionEndExcluding":"7.0.48","versionStartIncluding":"7.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"AA82232A-BCA7-4D49-8D7D-15DCB25CCFE5","versionEndExcluding":"8.0.37","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"09725104-53CB-4003-BC5F-84877562F81F","versionEndExcluding":"8.3.16","versionStartIncluding":"8.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"7CC10FFC-445C-4850-A91B-C4CE6911BFD6","versionEndExcluding":"9.0.7","versionStartIncluding":"9.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not."}],"id":"CVE-2026-118383","lastModified":"2026-11-13T15:56:12.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"cna@mongodb.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.5,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118383","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:14:20.952752Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:58.980","references":[{"source":"cna@mongodb.com","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://jira.mongodb.org/browse/SERVER-138119"},{"source":"cna@mongodb.com","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://jira.mongodb.org/browse/SERVER-138175"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118976.json b/data/2026/CVE-2026-118976.json
new file mode 100644
index 0000000000..954582cbac
--- /dev/null
+++ b/data/2026/CVE-2026-118976.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for Blazor","vendor":"Progress Software","versions":[{"lessThan":"14.1.0","status":"affected","version":"11.1.0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope."}],"id":"CVE-2026-118976","lastModified":"2026-11-13T15:17:32.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-13T15:17:32.237","references":[{"source":"security@progress.com","url":"https://www.telerik.com/blazor-ui/documentation/knowledge-base/kb-security-demo-path-traversal-cve-2026-118976"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security@progress.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-119102.json b/data/2026/CVE-2026-119102.json
new file mode 100644
index 0000000000..fbfd4c0f5d
--- /dev/null
+++ b/data/2026/CVE-2026-119102.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for Blazor","vendor":"Progress Software","versions":[{"lessThan":"16.0.0","status":"affected","version":"12.0.0","versionType":"semver"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist."}],"id":"CVE-2026-119102","lastModified":"2026-11-13T15:17:32.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-13T15:17:32.367","references":[{"source":"security@progress.com","url":"https://www.telerik.com/blazor-ui/documentation/knowledge-base/kb-security-improper-input-validation-cve-2026-119102"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security@progress.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-119512.json b/data/2026/CVE-2026-119512.json
new file mode 100644
index 0000000000..ebe3e12f3b
--- /dev/null
+++ b/data/2026/CVE-2026-119512.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"newsletters-lite","product":"Newsletters","vendor":"Tribulant Software","versions":[{"changes":[{"at":"4.18.3","status":"unaffected"}],"lessThanOrEqual":"4.18.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2."}],"id":"CVE-2026-119512","lastModified":"2026-11-13T15:17:32.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:32.490","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-2-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-119517.json b/data/2026/CVE-2026-119517.json
new file mode 100644
index 0000000000..f5726b0930
--- /dev/null
+++ b/data/2026/CVE-2026-119517.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"catna-woo-name-your-price-and-offers","product":"Catna – Woo Name Your Price and Offers","vendor":"VillaTheme","versions":[{"changes":[{"at":"2.0.4","status":"unaffected"}],"lessThanOrEqual":"2.0.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3."}],"id":"CVE-2026-119517","lastModified":"2026-11-13T15:17:32.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:32.630","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/catna-woo-name-your-price-and-offers/vulnerability/wordpress-catna-woo-name-your-price-and-offers-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-119518.json b/data/2026/CVE-2026-119518.json
index 840f7f66fb..24d570ec70 100644
--- a/data/2026/CVE-2026-119518.json
+++ b/data/2026/CVE-2026-119518.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"royal-elementor-addons","product":"Royal Elementor Addons","vendor":"WProyal","versions":[{"changes":[{"at":"1.7.1071","status":"unaffected"}],"lessThanOrEqual":"1.7.1070","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070."}],"id":"CVE-2026-119518","lastModified":"2026-11-13T13:17:54.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:17:54.187","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1070-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"royal-elementor-addons","product":"Royal Elementor Addons","vendor":"WProyal","versions":[{"changes":[{"at":"1.7.1071","status":"unaffected"}],"lessThanOrEqual":"1.7.1070","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070."}],"id":"CVE-2026-119518","lastModified":"2026-11-13T16:17:34.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119518","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:59.552519Z","version":"2.0.3"}}]},"published":"2026-11-13T13:17:54.187","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1070-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-119618.json b/data/2026/CVE-2026-119618.json
index 87b3b37660..013ba4c5c9 100644
--- a/data/2026/CVE-2026-119618.json
+++ b/data/2026/CVE-2026-119618.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-12T21:17:20.893","metrics":{},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://ubuntu.com/security/CVE-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-13T15:17:32.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:17:15.903768Z","version":"2.0.3"}}]},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://ubuntu.com/security/CVE-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120326.json b/data/2026/CVE-2026-120326.json
index de8a6d0905..7e82cab1ff 100644
--- a/data/2026/CVE-2026-120326.json
+++ b/data/2026/CVE-2026-120326.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin","product":"vaadin","repo":"https://github.com/vaadin/platform","vendor":"vaadin","versions":[{"lessThanOrEqual":"24.8.17","status":"affected","version":"24.8.0","versionType":"maven"},{"lessThan":"24.9.26","status":"affected","version":"24.9.0","versionType":"maven"},{"lessThan":"24.10.14","status":"affected","version":"24.10.0","versionType":"maven"},{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin-core","product":"vaadin-core","repo":"https://github.com/vaadin/platform","vendor":"vaadin","versions":[{"lessThanOrEqual":"24.8.17","status":"affected","version":"24.8.0","versionType":"maven"},{"lessThan":"24.9.26","status":"affected","version":"24.9.0","versionType":"maven"},{"lessThan":"24.10.14","status":"affected","version":"24.10.0","versionType":"maven"},{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:flow-server","product":"flow","repo":"https://github.com/vaadin/flow","vendor":"vaadin","versions":[{"lessThanOrEqual":"24.8.16","status":"affected","version":"24.8.0","versionType":"maven"},{"lessThan":"24.9.31","status":"affected","version":"24.9.0","versionType":"maven"},{"lessThan":"24.10.17","status":"affected","version":"24.10.0","versionType":"maven"},{"lessThanOrEqual":"25.0.15","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.19","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.16","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.6","status":"affected","version":"25.3.0","versionType":"maven"}]}],"source":"security@vaadin.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename=\"<name>\" with the name inserted verbatim, so a double quote in the name ends the quoted string early and the rest of the name is read by the browser as further header parameters. The inline(String) variant, present from Vaadin 25.0, builds the name the same way. An application that passes an untrusted file name to either method, for example when re-serving a file under the name it was uploaded with, lets an attacker add a filename* parameter. Browsers prefer filename* over filename, so the file is saved under a name and extension of the attacker's choosing, which defeats any file name or extension restriction the application enforces. The attacker cannot change the attachment or inline disposition itself and cannot split the header.\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 24.8.0 - 24.8.17\nVaadin 24.9.0 - 24.9.25\nVaadin 24.10.0 - 24.10.13\nVaadin 25.0.0 - 25.0.13\nVaadin 25.1.0 - 25.1.13\nVaadin 25.2.0 - 25.2.12\nVaadin 25.3.0 - 25.3.4\n\nMitigation\nNo fixed release on this line, upgrade to 24.9.26 or newer\nUpgrade to 24.9.26\nUpgrade to 24.10.14\nNo fixed release on this line, upgrade to 25.2.13 or newer\nNo fixed release on this line, upgrade to 25.2.13 or newer\nUpgrade to 25.2.13\nUpgrade to 25.3.5\n\nVaadin versions below 24.8 are not affected: the DownloadEvent API does not exist in them."}],"id":"CVE-2026-120326","lastModified":"2026-11-10T12:17:16.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@vaadin.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.837","references":[{"source":"security@vaadin.com","url":"https://github.com/vaadin/flow/pull/26704"},{"source":"security@vaadin.com","url":"https://vaadin.com/security/cve-2026-120326"}],"sourceIdentifier":"security@vaadin.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"security@vaadin.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin","product":"vaadin","repo":"https://github.com/vaadin/platform","vendor":"vaadin","versions":[{"lessThanOrEqual":"24.8.17","status":"affected","version":"24.8.0","versionType":"maven"},{"lessThan":"24.9.26","status":"affected","version":"24.9.0","versionType":"maven"},{"lessThan":"24.10.14","status":"affected","version":"24.10.0","versionType":"maven"},{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin-core","product":"vaadin-core","repo":"https://github.com/vaadin/platform","vendor":"vaadin","versions":[{"lessThanOrEqual":"24.8.17","status":"affected","version":"24.8.0","versionType":"maven"},{"lessThan":"24.9.26","status":"affected","version":"24.9.0","versionType":"maven"},{"lessThan":"24.10.14","status":"affected","version":"24.10.0","versionType":"maven"},{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:flow-server","product":"flow","repo":"https://github.com/vaadin/flow","vendor":"vaadin","versions":[{"lessThanOrEqual":"24.8.16","status":"affected","version":"24.8.0","versionType":"maven"},{"lessThan":"24.9.31","status":"affected","version":"24.9.0","versionType":"maven"},{"lessThan":"24.10.17","status":"affected","version":"24.10.0","versionType":"maven"},{"lessThanOrEqual":"25.0.15","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.19","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.16","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.6","status":"affected","version":"25.3.0","versionType":"maven"}]}],"source":"security@vaadin.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename=\"<name>\" with the name inserted verbatim, so a double quote in the name ends the quoted string early and the rest of the name is read by the browser as further header parameters. The inline(String) variant, present from Vaadin 25.0, builds the name the same way. An application that passes an untrusted file name to either method, for example when re-serving a file under the name it was uploaded with, lets an attacker add a filename* parameter. Browsers prefer filename* over filename, so the file is saved under a name and extension of the attacker's choosing, which defeats any file name or extension restriction the application enforces. The attacker cannot change the attachment or inline disposition itself and cannot split the header.\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 24.8.0 - 24.8.17\nVaadin 24.9.0 - 24.9.25\nVaadin 24.10.0 - 24.10.13\nVaadin 25.0.0 - 25.0.13\nVaadin 25.1.0 - 25.1.13\nVaadin 25.2.0 - 25.2.12\nVaadin 25.3.0 - 25.3.4\n\nMitigation\nNo fixed release on this line, upgrade to 24.9.26 or newer\nUpgrade to 24.9.26\nUpgrade to 24.10.14\nNo fixed release on this line, upgrade to 25.2.13 or newer\nNo fixed release on this line, upgrade to 25.2.13 or newer\nUpgrade to 25.2.13\nUpgrade to 25.3.5\n\nVaadin versions below 24.8 are not affected: the DownloadEvent API does not exist in them."}],"id":"CVE-2026-120326","lastModified":"2026-11-13T15:17:32.943","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@vaadin.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120326","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:29.596217Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.837","references":[{"source":"security@vaadin.com","url":"https://github.com/vaadin/flow/pull/26704"},{"source":"security@vaadin.com","url":"https://vaadin.com/security/cve-2026-120326"}],"sourceIdentifier":"security@vaadin.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"security@vaadin.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120350.json b/data/2026/CVE-2026-120350.json
index 1a4ac4a411..204e8b71e4 100644
--- a/data/2026/CVE-2026-120350.json
+++ b/data/2026/CVE-2026-120350.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin","product":"vaadin","repo":"https://github.com/vaadin/platform","vendor":"vaadin","versions":[{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin-core","product":"vaadin-core","repo":"https://github.com/vaadin/platform","vendor":"vaadin","versions":[{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin-rich-text-editor-flow","product":"vaadin-rich-text-editor-flow","repo":"https://github.com/vaadin/flow-components","vendor":"vaadin","versions":[{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://registry.npmjs.org","defaultStatus":"unaffected","packageName":"@vaadin/rich-text-editor","product":"rich-text-editor","repo":"https://github.com/vaadin/web-components","vendor":"vaadin","versions":[{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"semver"},{"lessThanOrEqual":"25.1.14","status":"affected","version":"25.1.0","versionType":"semver"},{"lessThan":"25.2.17","status":"affected","version":"25.2.0","versionType":"semver"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"semver"}]}],"source":"security@vaadin.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying the payload, the delta is stored, and the script runs when any user opens the page, including in read only mode.\n\nOnly content persisted through asDelta() is affected. The default HTML value, set and read through setValue and getValue, is sanitized on the server with a safelist that has no iframe, so the embed does not survive that path. Vaadin 24 and older are not affected: they build the HTML value from the editor's own innerHTML, which the browser escapes.\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 25.0.0 - 25.0.13\nVaadin 25.1.0 - 25.1.13\nVaadin 25.2.0 - 25.2.12\nVaadin 25.3.0 - 25.3.4\n\nMitigation\nNo fixed release on this line, upgrade to 25.2.13 or newer\nNo fixed release on this line, upgrade to 25.2.13 or newer\nUpgrade to 25.2.13\nUpgrade to 25.3.5"}],"id":"CVE-2026-120350","lastModified":"2026-11-10T12:17:17.170","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@vaadin.com","type":"Secondary"}]},"published":"2026-11-10T12:17:17.050","references":[{"source":"security@vaadin.com","url":"https://github.com/advisories/GHSA-v3m3-f69x-jf25"},{"source":"security@vaadin.com","url":"https://github.com/vaadin/web-components/pull/13272"},{"source":"security@vaadin.com","url":"https://vaadin.com/security/cve-2026-120350"}],"sourceIdentifier":"security@vaadin.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@vaadin.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin","product":"vaadin","repo":"https://github.com/vaadin/platform","vendor":"vaadin","versions":[{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin-core","product":"vaadin-core","repo":"https://github.com/vaadin/platform","vendor":"vaadin","versions":[{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.vaadin:vaadin-rich-text-editor-flow","product":"vaadin-rich-text-editor-flow","repo":"https://github.com/vaadin/flow-components","vendor":"vaadin","versions":[{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"maven"},{"lessThanOrEqual":"25.1.13","status":"affected","version":"25.1.0","versionType":"maven"},{"lessThan":"25.2.13","status":"affected","version":"25.2.0","versionType":"maven"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"maven"}]},{"collectionURL":"https://registry.npmjs.org","defaultStatus":"unaffected","packageName":"@vaadin/rich-text-editor","product":"rich-text-editor","repo":"https://github.com/vaadin/web-components","vendor":"vaadin","versions":[{"lessThanOrEqual":"25.0.13","status":"affected","version":"25.0.0","versionType":"semver"},{"lessThanOrEqual":"25.1.14","status":"affected","version":"25.1.0","versionType":"semver"},{"lessThan":"25.2.17","status":"affected","version":"25.2.0","versionType":"semver"},{"lessThan":"25.3.5","status":"affected","version":"25.3.0","versionType":"semver"}]}],"source":"security@vaadin.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying the payload, the delta is stored, and the script runs when any user opens the page, including in read only mode.\n\nOnly content persisted through asDelta() is affected. The default HTML value, set and read through setValue and getValue, is sanitized on the server with a safelist that has no iframe, so the embed does not survive that path. Vaadin 24 and older are not affected: they build the HTML value from the editor's own innerHTML, which the browser escapes.\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 25.0.0 - 25.0.13\nVaadin 25.1.0 - 25.1.13\nVaadin 25.2.0 - 25.2.12\nVaadin 25.3.0 - 25.3.4\n\nMitigation\nNo fixed release on this line, upgrade to 25.2.13 or newer\nNo fixed release on this line, upgrade to 25.2.13 or newer\nUpgrade to 25.2.13\nUpgrade to 25.3.5"}],"id":"CVE-2026-120350","lastModified":"2026-11-13T15:17:33.117","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@vaadin.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:32.180656Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:17.050","references":[{"source":"security@vaadin.com","url":"https://github.com/advisories/GHSA-v3m3-f69x-jf25"},{"source":"security@vaadin.com","url":"https://github.com/vaadin/web-components/pull/13272"},{"source":"security@vaadin.com","url":"https://vaadin.com/security/cve-2026-120350"}],"sourceIdentifier":"security@vaadin.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@vaadin.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120407.json b/data/2026/CVE-2026-120407.json
index bc5c69a61a..fd2cbf88cd 100644
--- a/data/2026/CVE-2026-120407.json
+++ b/data/2026/CVE-2026-120407.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Contact Form 7","vendor":"Unknown","versions":[{"lessThan":"6.2.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form."}],"id":"CVE-2026-120407","lastModified":"2026-11-13T06:16:53.093","metrics":{},"published":"2026-11-13T06:16:53.093","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/a981358b-6736-4d46-9352-b57a11dbcb54/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Contact Form 7","vendor":"Unknown","versions":[{"lessThan":"6.2.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form."}],"id":"CVE-2026-120407","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.093","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/a981358b-6736-4d46-9352-b57a11dbcb54/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-120835.json b/data/2026/CVE-2026-120835.json
new file mode 100644
index 0000000000..1b85aeac3d
--- /dev/null
+++ b/data/2026/CVE-2026-120835.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"affi-affiliate-marketing-for-woo","product":"AFFI – Affiliate Marketing for WooCommerce","vendor":"VillaTheme","versions":[{"changes":[{"at":"1.0.12","status":"unaffected"}],"lessThanOrEqual":"1.0.11","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11."}],"id":"CVE-2026-120835","lastModified":"2026-11-13T15:17:33.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:33.290","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-121191.json b/data/2026/CVE-2026-121191.json
index 8148f22641..97ec37e17e 100644
--- a/data/2026/CVE-2026-121191.json
+++ b/data/2026/CVE-2026-121191.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"eta-remote","vendor":"TÜBİTAK BİLGEM Software Technologies Research Institute","versions":[{"lessThan":"0.0.3","status":"affected","version":"0.0.2","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects eta-remote: from 0.0.2 before 0.0.3."}],"id":"CVE-2026-121191","lastModified":"2026-11-10T16:24:34.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-10T12:17:17.240","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1498"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"eta-remote","vendor":"TÜBİTAK BİLGEM Software Technologies Research Institute","versions":[{"lessThan":"0.0.3","status":"affected","version":"0.0.2","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects eta-remote: from 0.0.2 before 0.0.3."}],"id":"CVE-2026-121191","lastModified":"2026-11-13T15:17:33.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"iletisim@usom.gov.tr","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:34.809192Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:17.240","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1498"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"iletisim@usom.gov.tr","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121721.json b/data/2026/CVE-2026-121721.json
index dbad7b1040..12063fcaca 100644
--- a/data/2026/CVE-2026-121721.json
+++ b/data/2026/CVE-2026-121721.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"advanced-gutenberg","product":"Gutenberg Blocks","vendor":"PublishPress","versions":[{"changes":[{"at":"3.7.7","status":"unaffected"}],"lessThanOrEqual":"3.7.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Stored XSS.This issue affects Gutenberg Blocks: from n/a through 3.7.6."}],"id":"CVE-2026-121721","lastModified":"2026-11-13T13:17:55.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:17:55.390","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-plugin-3-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"advanced-gutenberg","product":"Gutenberg Blocks","vendor":"PublishPress","versions":[{"changes":[{"at":"3.7.7","status":"unaffected"}],"lessThanOrEqual":"3.7.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Stored XSS.This issue affects Gutenberg Blocks: from n/a through 3.7.6."}],"id":"CVE-2026-121721","lastModified":"2026-11-13T16:17:35.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121721","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:57.337561Z","version":"2.0.3"}}]},"published":"2026-11-13T13:17:55.390","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-plugin-3-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121776.json b/data/2026/CVE-2026-121776.json
new file mode 100644
index 0000000000..e32fbd1400
--- /dev/null
+++ b/data/2026/CVE-2026-121776.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"content-protector","product":"Passster","vendor":"WP Chill","versions":[{"changes":[{"at":"4.3.21","status":"unaffected"}],"lessThanOrEqual":"4.3.20","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20."}],"id":"CVE-2026-121776","lastModified":"2026-11-13T15:17:33.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:33.560","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/content-protector/vulnerability/wordpress-passster-plugin-4-3-20-broken-access-control-vulnerability-2?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-121808.json b/data/2026/CVE-2026-121808.json
new file mode 100644
index 0000000000..5cdac27f5b
--- /dev/null
+++ b/data/2026/CVE-2026-121808.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Codec.Erlpack'"],"packageName":"grpc","packageURL":"pkg:hex/grpc","product":"grpc","programFiles":["lib/grpc/codec/erlpack.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Codec.Erlpack':decode/2"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.0.0","status":"affected","version":"0.4.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Codec.Erlpack'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc","programFiles":["lib/grpc/codec/erlpack.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Codec.Erlpack':decode/2"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"0332faae5f5e132314794dbfdae5edecbccea292","status":"affected","version":"25bcc569fe2cc4478531a6c546c923205fc751c9","versionType":"git"}]},{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Codec.Erlpack'"],"packageName":"grpc_core","packageURL":"pkg:hex/grpc_core","product":"grpc_core","programFiles":["lib/grpc/codec/erlpack.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Codec.Erlpack':decode/2"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.1.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Codec.Erlpack'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc_core","programFiles":["grpc_core/lib/grpc/codec/erlpack.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Codec.Erlpack':decode/2"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"d6bc56ac75dfb6c02db2099909210a37c9be8db6","status":"affected","version":"0332faae5f5e132314794dbfdae5edecbccea292","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\nGRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."}],"id":"CVE-2026-121808","lastModified":"2026-11-13T16:17:36.760","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-13T16:17:36.760","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-121808.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/d6bc56ac75dfb6c02db2099909210a37c9be8db6"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xxp9-7hp4-rqwp"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-121808"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121853.json b/data/2026/CVE-2026-121853.json
index 0cb221adc1..00175a2290 100644
--- a/data/2026/CVE-2026-121853.json
+++ b/data/2026/CVE-2026-121853.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AppPresser","vendor":"Unknown","versions":[{"lessThan":"5.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AppPresser  WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser  WordPress plugin before 5.0.0 and its ."}],"id":"CVE-2026-121853","lastModified":"2026-11-13T06:16:53.183","metrics":{},"published":"2026-11-13T06:16:53.183","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/674849e9-44ad-496f-baba-6d17d58b5807/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AppPresser","vendor":"Unknown","versions":[{"lessThan":"5.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AppPresser  WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser  WordPress plugin before 5.0.0 and its ."}],"id":"CVE-2026-121853","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.183","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/674849e9-44ad-496f-baba-6d17d58b5807/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-12266.json b/data/2026/CVE-2026-12266.json
index 75cf1300cc..927d85c1e1 100644
--- a/data/2026/CVE-2026-12266.json
+++ b/data/2026/CVE-2026-12266.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6201","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API."}],"id":"CVE-2026-12266","lastModified":"2026-11-10T22:19:12.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-10T12:17:19.400","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6201","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API."}],"id":"CVE-2026-12266","lastModified":"2026-11-13T15:17:45.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:27.200920Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:19.400","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123082.json b/data/2026/CVE-2026-123082.json
index 1713cb1596..d396a34c8b 100644
--- a/data/2026/CVE-2026-123082.json
+++ b/data/2026/CVE-2026-123082.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","platforms":["Linux","MacOS","Windows"],"product":"Docker Desktop","vendor":"Docker","versions":[{"lessThan":"4.94.0","status":"affected","version":"4.43.0","versionType":"semver"},{"status":"unaffected","version":"4.94.0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading."}],"id":"CVE-2026-123082","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-10T15:17:16.033","references":[{"source":"security@docker.com","url":"https://docs.docker.com/desktop/release-notes/#4940"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@docker.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","platforms":["Linux","MacOS","Windows"],"product":"Docker Desktop","vendor":"Docker","versions":[{"lessThan":"4.94.0","status":"affected","version":"4.43.0","versionType":"semver"},{"status":"unaffected","version":"4.94.0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading."}],"id":"CVE-2026-123082","lastModified":"2026-11-13T15:17:33.703","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123082","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:37.065673Z","version":"2.0.3"}}]},"published":"2026-11-10T15:17:16.033","references":[{"source":"security@docker.com","url":"https://docs.docker.com/desktop/release-notes/#4940"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@docker.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123093.json b/data/2026/CVE-2026-123093.json
index 605d530f81..3e602bd5c0 100644
--- a/data/2026/CVE-2026-123093.json
+++ b/data/2026/CVE-2026-123093.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Remote Users Sync","vendor":"Unknown","versions":[{"lessThan":"2.2.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log."}],"id":"CVE-2026-123093","lastModified":"2026-11-13T06:16:53.293","metrics":{},"published":"2026-11-13T06:16:53.293","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/d5082119-feab-4978-b975-fd86a91b68a0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Remote Users Sync","vendor":"Unknown","versions":[{"lessThan":"2.2.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log."}],"id":"CVE-2026-123093","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.293","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/d5082119-feab-4978-b975-fd86a91b68a0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-123097.json b/data/2026/CVE-2026-123097.json
index b8ec7fc42f..ade77565eb 100644
--- a/data/2026/CVE-2026-123097.json
+++ b/data/2026/CVE-2026-123097.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Remote Users Sync","vendor":"Unknown","versions":[{"lessThan":"2.2.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions."}],"id":"CVE-2026-123097","lastModified":"2026-11-13T06:16:53.387","metrics":{},"published":"2026-11-13T06:16:53.387","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9df17b10-261c-4d93-a24d-76b10b65456f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Remote Users Sync","vendor":"Unknown","versions":[{"lessThan":"2.2.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions."}],"id":"CVE-2026-123097","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.387","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9df17b10-261c-4d93-a24d-76b10b65456f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-123124.json b/data/2026/CVE-2026-123124.json
index 86f9d8bd4c..c75bb3091e 100644
--- a/data/2026/CVE-2026-123124.json
+++ b/data/2026/CVE-2026-123124.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"WooCommerce Vindi Pagamento","vendor":"Unknown","versions":[{"lessThanOrEqual":"0.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway.\nThe stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage."}],"id":"CVE-2026-123124","lastModified":"2026-11-13T06:16:53.487","metrics":{},"published":"2026-11-13T06:16:53.487","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/861d57fa-54dd-4980-8f0e-9d8a2874072f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"WooCommerce Vindi Pagamento","vendor":"Unknown","versions":[{"lessThanOrEqual":"0.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway.\nThe stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage."}],"id":"CVE-2026-123124","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.487","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/861d57fa-54dd-4980-8f0e-9d8a2874072f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-123181.json b/data/2026/CVE-2026-123181.json
index e225204a65..226a828668 100644
--- a/data/2026/CVE-2026-123181.json
+++ b/data/2026/CVE-2026-123181.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3"},{"status":"unaffected","version":"10.7.4"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges."}],"id":"CVE-2026-123181","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":4.2,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:18.503","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3"},{"status":"unaffected","version":"10.7.4"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges."}],"id":"CVE-2026-123181","lastModified":"2026-11-13T15:17:33.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":4.2,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:41.675760Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.503","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123635.json b/data/2026/CVE-2026-123635.json
new file mode 100644
index 0000000000..ef0f479ac2
--- /dev/null
+++ b/data/2026/CVE-2026-123635.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["grpc_stream_h"],"packageName":"grpc_server","packageURL":"pkg:hex/grpc_server","product":"grpc_server","programFiles":["src/grpc_stream_h.erl"],"programRoutines":[{"name":"grpc_stream_h:init/3"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.1.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["grpc_stream_h"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc_server","programFiles":["grpc_server/src/grpc_stream_h.erl"],"programRoutines":[{"name":"grpc_stream_h:init/3"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"61a71948e6e7b95efb27d48e7084c764503cc802","status":"affected","version":"0332faae5f5e132314794dbfdae5edecbccea292","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."}],"id":"CVE-2026-123635","lastModified":"2026-11-13T16:17:37.023","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-13T16:17:37.023","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-123635.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-123635"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123670.json b/data/2026/CVE-2026-123670.json
index a4284fa2b9..05be98d3a8 100644
--- a/data/2026/CVE-2026-123670.json
+++ b/data/2026/CVE-2026-123670.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Essential Real Estate","vendor":"Unknown","versions":[{"lessThan":"5.3.6","status":"affected","version":"5.3.5","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site."}],"id":"CVE-2026-123670","lastModified":"2026-11-13T06:16:53.587","metrics":{},"published":"2026-11-13T06:16:53.587","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/04d772fe-001d-4f25-a11a-dedf16064ce4/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Essential Real Estate","vendor":"Unknown","versions":[{"lessThan":"5.3.6","status":"affected","version":"5.3.5","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site."}],"id":"CVE-2026-123670","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.587","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/04d772fe-001d-4f25-a11a-dedf16064ce4/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-123710.json b/data/2026/CVE-2026-123710.json
index fc709702f5..ae6e03b504 100644
--- a/data/2026/CVE-2026-123710.json
+++ b/data/2026/CVE-2026-123710.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/quay/quay","defaultStatus":"unaffected","packageName":"quay","product":"quay","vendor":"Project Quay","versions":[{"lessThan":"3.9.28","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.10.28","status":"affected","version":"3.10.0","versionType":"semver"},{"lessThan":"3.12.24","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.10","status":"affected","version":"3.14.0","versionType":"semver"},{"lessThan":"3.15.9","status":"affected","version":"3.15.0","versionType":"semver"},{"lessThan":"3.16.7","status":"affected","version":"3.16.0","versionType":"semver"},{"lessThan":"3.17.7","status":"affected","version":"3.17.0","versionType":"semver"},{"lessThan":"3.18.3","status":"affected","version":"3.18.0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993674","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993854","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.14::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993848","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.15::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993799","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993778","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.18::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993890","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993730","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:5"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags."}],"id":"CVE-2026-123710","lastModified":"2026-11-13T02:18:50.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T15:17:18.340","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99019"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99021"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99022"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99023"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99024"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99025"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99026"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99027"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123710"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/solutions/7149923"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2568072"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/quay/quay","defaultStatus":"unaffected","packageName":"quay","product":"quay","vendor":"Project Quay","versions":[{"lessThan":"3.9.28","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.10.28","status":"affected","version":"3.10.0","versionType":"semver"},{"lessThan":"3.12.24","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.10","status":"affected","version":"3.14.0","versionType":"semver"},{"lessThan":"3.15.9","status":"affected","version":"3.15.0","versionType":"semver"},{"lessThan":"3.16.7","status":"affected","version":"3.16.0","versionType":"semver"},{"lessThan":"3.17.7","status":"affected","version":"3.17.0","versionType":"semver"},{"lessThan":"3.18.3","status":"affected","version":"3.18.0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993674","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993854","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.14::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993848","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.15::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993799","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993778","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.18::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993890","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993730","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:5"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","matchCriteriaId":"EB56B55D-A2FA-40C1-A34C-DFC0B096D3E6","versionEndExcluding":"3.9.28","versionStartIncluding":"3.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","matchCriteriaId":"DD4E101F-5CBD-4875-9F14-B6A8879AB5F4","versionEndExcluding":"3.10.28","versionStartIncluding":"3.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","matchCriteriaId":"6F9D903B-5D40-4976-8F37-FCBF64A05A73","versionEndExcluding":"3.12.24","versionStartIncluding":"3.12.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","matchCriteriaId":"53D23428-6E65-4B22-88AE-ADF8002A5B33","versionEndExcluding":"3.14.10","versionStartIncluding":"3.14.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","matchCriteriaId":"FDE03C4B-93FF-46F2-BBC9-C146BF64E2D2","versionEndExcluding":"3.15.9","versionStartIncluding":"3.15.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","matchCriteriaId":"9EB0A23E-3584-48B3-A60F-924F50AA93C2","versionEndExcluding":"3.16.7","versionStartIncluding":"3.16.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","matchCriteriaId":"DD27A54E-C354-4DE8-8A40-88971E48259C","versionEndExcluding":"3.17.7","versionStartIncluding":"3.17.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*","matchCriteriaId":"4C08D9B5-69B2-4E08-BDFE-2122114618AA","versionEndExcluding":"3.18.3","versionStartIncluding":"3.18.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags."}],"id":"CVE-2026-123710","lastModified":"2026-11-13T15:17:33.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123710","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:17:57.069419Z","version":"2.0.3"}}]},"published":"2026-11-11T15:17:18.340","references":[{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:99019"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:99021"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:99022"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:99023"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:99024"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:99025"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:99026"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:99027"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-123710"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/solutions/7149923"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2568072"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123711.json b/data/2026/CVE-2026-123711.json
index a568df1c32..8713372ba9 100644
--- a/data/2026/CVE-2026-123711.json
+++ b/data/2026/CVE-2026-123711.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WPCOM Member","vendor":"Unknown","versions":[{"lessThan":"1.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing unauthenticated attackers to brute-force a code issued to another user and log in as that user, including administrators, when WeChat official-account keyword login is enabled."}],"id":"CVE-2026-123711","lastModified":"2026-11-13T06:16:53.687","metrics":{},"published":"2026-11-13T06:16:53.687","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/7d7ca1b4-0d9e-4127-8252-cfe0bb51b18a/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WPCOM Member","vendor":"Unknown","versions":[{"lessThan":"1.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing unauthenticated attackers to brute-force a code issued to another user and log in as that user, including administrators, when WeChat official-account keyword login is enabled."}],"id":"CVE-2026-123711","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.687","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/7d7ca1b4-0d9e-4127-8252-cfe0bb51b18a/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-123975.json b/data/2026/CVE-2026-123975.json
new file mode 100644
index 0000000000..82bac5a462
--- /dev/null
+++ b/data/2026/CVE-2026-123975.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/gridcf/gct","product":"Grid Community Toolkit","repo":"https://github.com/gridcf/gct","vendor":"Grid Community Forum","versions":[{"lessThan":"6.2.20261111","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","packageURL":"pkg:github/gridcf/gct","product":"globus-gss-assist","repo":"https://github.com/gridcf/gct","vendor":"Grid Community Forum","versions":[{"lessThan":"12.9","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus_gss_assist_token_get_fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service."}],"id":"CVE-2026-123975","lastModified":"2026-11-13T15:17:34.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T15:17:34.120","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/gridcf/gct/blob/v6.2.20190829/gsi/gss_assist/source/tokens_f.c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gridcf/gct/commit/3df2be4834c146bdcec90009a0f2e5771ff63cca"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gridcf/gct/releases/tag/v6.2.20261111"},{"source":"disclosure@vulncheck.com","url":"https://gridcf.org/#2026-11-11"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/grid-community-toolkit-globus-gss-assist-before-12.9-pre-authentication-heap-out-of-bounds-write"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124002.json b/data/2026/CVE-2026-124002.json
index 3cbb990a9a..4f63eeebe0 100644
--- a/data/2026/CVE-2026-124002.json
+++ b/data/2026/CVE-2026-124002.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.7.0","status":"affected","version":"5.2.3","versionType":"semver"},{"status":"unaffected","version":"5.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124002","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:21.597","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.7.0","status":"affected","version":"5.2.3","versionType":"semver"},{"status":"unaffected","version":"5.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124002","lastModified":"2026-11-13T15:17:34.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:21.597","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124003.json b/data/2026/CVE-2026-124003.json
index 5e618c0694..0f329b4e15 100644
--- a/data/2026/CVE-2026-124003.json
+++ b/data/2026/CVE-2026-124003.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system(\"/usr/bin/lua \"+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124003","lastModified":"2026-11-13T02:18:50.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124003","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:24:15.418088Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:21.917","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-setuid-lua-cgi-root-command-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system(\"/usr/bin/lua \"+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124003","lastModified":"2026-11-13T15:17:34.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124003","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:24:15.418088Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:21.917","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-setuid-lua-cgi-root-command-injection"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124004.json b/data/2026/CVE-2026-124004.json
index 21e496fa14..484360f045 100644
--- a/data/2026/CVE-2026-124004.json
+++ b/data/2026/CVE-2026-124004.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124004","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:22.367","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-backdoor-password"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124004","lastModified":"2026-11-13T15:17:34.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:22.367","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-backdoor-password"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124005.json b/data/2026/CVE-2026-124005.json
index cab0e3a7cd..dfba63d7cc 100644
--- a/data/2026/CVE-2026-124005.json
+++ b/data/2026/CVE-2026-124005.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124005","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:22.673","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124005","lastModified":"2026-11-13T15:17:34.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:22.673","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124006.json b/data/2026/CVE-2026-124006.json
index a09413bdc5..1bfafc479c 100644
--- a/data/2026/CVE-2026-124006.json
+++ b/data/2026/CVE-2026-124006.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124006","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.033","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"},{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124006","lastModified":"2026-11-13T15:17:34.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.033","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"},{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124007.json b/data/2026/CVE-2026-124007.json
index 3a65e6c413..847b632fbd 100644
--- a/data/2026/CVE-2026-124007.json
+++ b/data/2026/CVE-2026-124007.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124007","lastModified":"2026-11-13T02:18:50.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124007","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:25:48.773780Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:23.387","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-auth-os-command-injection-via-password-field"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124007","lastModified":"2026-11-13T15:17:34.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124007","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:25:48.773780Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:23.387","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-auth-os-command-injection-via-password-field"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124008.json b/data/2026/CVE-2026-124008.json
index 16d5c656fe..4b0f688057 100644
--- a/data/2026/CVE-2026-124008.json
+++ b/data/2026/CVE-2026-124008.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.2.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124008","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.653","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-devices-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.2.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124008","lastModified":"2026-11-13T15:17:35.037","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.653","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-devices-lua"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124009.json b/data/2026/CVE-2026-124009.json
index 47f1156739..f525bf6b36 100644
--- a/data/2026/CVE-2026-124009.json
+++ b/data/2026/CVE-2026-124009.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.2.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124009","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.960","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-backup-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.2.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124009","lastModified":"2026-11-13T15:17:35.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.960","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-backup-lua"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124010.json b/data/2026/CVE-2026-124010.json
index 6aa720df7c..44fa931d7e 100644
--- a/data/2026/CVE-2026-124010.json
+++ b/data/2026/CVE-2026-124010.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124010","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:24.263","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cgi"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124010","lastModified":"2026-11-13T15:17:35.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:24.263","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cgi"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124011.json b/data/2026/CVE-2026-124011.json
index 4dd8ee8538..c012d5e275 100644
--- a/data/2026/CVE-2026-124011.json
+++ b/data/2026/CVE-2026-124011.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124011","lastModified":"2026-11-13T02:18:51.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124011","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:26:21.626257Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:24.670","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124011","lastModified":"2026-11-13T15:17:35.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124011","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:26:21.626257Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:24.670","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124012.json b/data/2026/CVE-2026-124012.json
index eea2b9c2fd..1ccf8c0cc6 100644
--- a/data/2026/CVE-2026-124012.json
+++ b/data/2026/CVE-2026-124012.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124012","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:24.970","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-daily-password-authentication-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124012","lastModified":"2026-11-13T15:17:35.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:24.970","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-daily-password-authentication-bypass"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124013.json b/data/2026/CVE-2026-124013.json
index 4a43cf6fe3..b4c00579bf 100644
--- a/data/2026/CVE-2026-124013.json
+++ b/data/2026/CVE-2026-124013.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124013","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:25.237","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124013","lastModified":"2026-11-13T15:17:35.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:25.237","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124014.json b/data/2026/CVE-2026-124014.json
index c2e2251ee6..29a5b12202 100644
--- a/data/2026/CVE-2026-124014.json
+++ b/data/2026/CVE-2026-124014.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124014","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:25.590","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124014","lastModified":"2026-11-13T15:17:35.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:25.590","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124015.json b/data/2026/CVE-2026-124015.json
index cfb10b9fac..8743e5c439 100644
--- a/data/2026/CVE-2026-124015.json
+++ b/data/2026/CVE-2026-124015.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124015","lastModified":"2026-11-13T02:18:51.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124015","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:39:52.966085Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:26.277","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-authentication-bypass-via-users-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124015","lastModified":"2026-11-13T15:17:35.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124015","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:39:52.966085Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:26.277","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-authentication-bypass-via-users-lua"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124260.json b/data/2026/CVE-2026-124260.json
new file mode 100644
index 0000000000..ad907e173d
--- /dev/null
+++ b/data/2026/CVE-2026-124260.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-photo-album-plus","product":"WP Photo Album Plus","vendor":"Jacob N. Breetvelt","versions":[{"changes":[{"at":"9.3.06.002","status":"unaffected"}],"lessThanOrEqual":"9.3.06.001","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.06.001."}],"id":"CVE-2026-124260","lastModified":"2026-11-13T16:17:37.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124260","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:10.752107Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:35.997","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-3-06-001-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124265.json b/data/2026/CVE-2026-124265.json
new file mode 100644
index 0000000000..e5b4ae8676
--- /dev/null
+++ b/data/2026/CVE-2026-124265.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"newsletters-lite","product":"Newsletters","vendor":"Tribulant Software","versions":[{"changes":[{"at":"4.18.2","status":"unaffected"}],"lessThanOrEqual":"4.18.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1."}],"id":"CVE-2026-124265","lastModified":"2026-11-13T15:17:36.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.133","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-sql-injection-vulnerability-2?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124267.json b/data/2026/CVE-2026-124267.json
new file mode 100644
index 0000000000..8eefb7190a
--- /dev/null
+++ b/data/2026/CVE-2026-124267.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"gmail-smtp","product":"Gmail SMTP","vendor":"Noor Alam","versions":[{"changes":[{"at":"1.2.3.24","status":"unaffected"}],"lessThanOrEqual":"1.2.3.23","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23."}],"id":"CVE-2026-124267","lastModified":"2026-11-13T15:17:36.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.270","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/gmail-smtp/vulnerability/wordpress-gmail-smtp-plugin-1-2-3-23-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124272.json b/data/2026/CVE-2026-124272.json
new file mode 100644
index 0000000000..9a0e3edd4e
--- /dev/null
+++ b/data/2026/CVE-2026-124272.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"salon-booking-system","product":"Salon booking system","vendor":"Dimitri Grassi","versions":[{"changes":[{"at":"10.31.15","status":"unaffected"}],"lessThanOrEqual":"10.31.14","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.14."}],"id":"CVE-2026-124272","lastModified":"2026-11-13T16:17:38.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124272","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:07.889270Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:36.410","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-31-14-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124278.json b/data/2026/CVE-2026-124278.json
new file mode 100644
index 0000000000..24aa49fee4
--- /dev/null
+++ b/data/2026/CVE-2026-124278.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server'","'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"],"packageName":"grpc_server","packageURL":"pkg:hex/grpc_server","product":"grpc_server","programFiles":["lib/grpc/server.ex","lib/grpc/server/adapters/cowboy/handler.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server':do_handle_request/4"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.1.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server'","'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc_server","programFiles":["grpc_server/lib/grpc/server.ex","grpc_server/lib/grpc/server/adapters/cowboy/handler.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server':do_handle_request/4"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"953ab980d8a127e895d3ab9505fc4b9337bb32f7","status":"affected","version":"0332faae5f5e132314794dbfdae5edecbccea292","versionType":"git"}]},{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server'","'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"],"packageName":"grpc","packageURL":"pkg:hex/grpc","product":"grpc","programFiles":["lib/grpc/server.ex","lib/grpc/server/adapters/cowboy/handler.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server':do_handle_request/4"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.0.0","status":"affected","version":"0.8.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server'","'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc","programFiles":["lib/grpc/server.ex","lib/grpc/server/adapters/cowboy/handler.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server':do_handle_request/4"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"0332faae5f5e132314794dbfdae5edecbccea292","status":"affected","version":"8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."}],"id":"CVE-2026-124278","lastModified":"2026-11-13T16:17:39.297","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-13T16:17:39.297","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-124278.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-124278"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-639"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124409.json b/data/2026/CVE-2026-124409.json
new file mode 100644
index 0000000000..6109b465bc
--- /dev/null
+++ b/data/2026/CVE-2026-124409.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"woo-multi-currency","product":"CURCY","vendor":"VillaTheme","versions":[{"changes":[{"at":"2.2.22","status":"unaffected"}],"lessThanOrEqual":"2.2.21","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21."}],"id":"CVE-2026-124409","lastModified":"2026-11-13T15:17:36.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.547","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/woo-multi-currency/vulnerability/wordpress-curcy-plugin-2-2-21-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124410.json b/data/2026/CVE-2026-124410.json
new file mode 100644
index 0000000000..09e2fc3641
--- /dev/null
+++ b/data/2026/CVE-2026-124410.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wplingua","product":"Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua","vendor":"wpLingua Translation Service","versions":[{"changes":[{"at":"3.2.0","status":"unaffected"}],"lessThanOrEqual":"3.1.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua: from n/a through 3.1.1."}],"id":"CVE-2026-124410","lastModified":"2026-11-13T16:17:39.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124410","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:56:58.734777Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:36.683","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wplingua/vulnerability/wordpress-translate-and-boost-seo-automatic-ai-translation-wplingua-plugin-3-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124412.json b/data/2026/CVE-2026-124412.json
new file mode 100644
index 0000000000..520cd4facd
--- /dev/null
+++ b/data/2026/CVE-2026-124412.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"slim-seo","product":"Slim SEO","vendor":"eLightUp","versions":[{"changes":[{"at":"4.11.6","status":"unaffected"}],"lessThanOrEqual":"4.11.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5."}],"id":"CVE-2026-124412","lastModified":"2026-11-13T15:17:36.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.820","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/slim-seo/vulnerability/wordpress-slim-seo-plugin-4-11-5-content-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124414.json b/data/2026/CVE-2026-124414.json
new file mode 100644
index 0000000000..52d9ec3e68
--- /dev/null
+++ b/data/2026/CVE-2026-124414.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"videowhisper-live-streaming-integration","product":"Broadcast Live Video","vendor":"VideoWhisper.com","versions":[{"changes":[{"at":"7.3.16","status":"unaffected"}],"lessThanOrEqual":"7.3.15","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15."}],"id":"CVE-2026-124414","lastModified":"2026-11-13T15:17:37.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.983","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-3-15-broken-authentication-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124415.json b/data/2026/CVE-2026-124415.json
new file mode 100644
index 0000000000..594e0e08ad
--- /dev/null
+++ b/data/2026/CVE-2026-124415.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"alex-reservations","product":"Alex Reservations","vendor":"Alejandro","versions":[{"changes":[{"at":"2.4.9","status":"unaffected"}],"lessThanOrEqual":"2.4.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8."}],"id":"CVE-2026-124415","lastModified":"2026-11-13T15:17:37.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:37.130","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/alex-reservations/vulnerability/wordpress-alex-reservations-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124418.json b/data/2026/CVE-2026-124418.json
new file mode 100644
index 0000000000..99d172d863
--- /dev/null
+++ b/data/2026/CVE-2026-124418.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-job-portal","product":"WP Job Portal","vendor":"Ahmad","versions":[{"changes":[{"at":"2.8.0","status":"unaffected"}],"lessThanOrEqual":"2.7.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.7.2."}],"id":"CVE-2026-124418","lastModified":"2026-11-13T16:17:40.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124418","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:04.968268Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:37.267","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124420.json b/data/2026/CVE-2026-124420.json
new file mode 100644
index 0000000000..dd8adc9576
--- /dev/null
+++ b/data/2026/CVE-2026-124420.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"insert-php","product":"Woody ad snippets","vendor":"Themeisle","versions":[{"changes":[{"at":"2.7.11","status":"unaffected"}],"lessThanOrEqual":"2.7.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10."}],"id":"CVE-2026-124420","lastModified":"2026-11-13T16:17:41.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124420","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:13.388977Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:37.403","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/insert-php/vulnerability/wordpress-woody-ad-snippets-plugin-2-7-10-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124664.json b/data/2026/CVE-2026-124664.json
index d0f1e00404..a270f188cb 100644
--- a/data/2026/CVE-2026-124664.json
+++ b/data/2026/CVE-2026-124664.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mine CloudVod","vendor":"Unknown","versions":[{"lessThan":"2.6.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons."}],"id":"CVE-2026-124664","lastModified":"2026-11-13T06:16:53.773","metrics":{},"published":"2026-11-13T06:16:53.773","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/92b85179-c9b3-44a4-b72d-26c43b3a61bc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mine CloudVod","vendor":"Unknown","versions":[{"lessThan":"2.6.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons."}],"id":"CVE-2026-124664","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.773","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/92b85179-c9b3-44a4-b72d-26c43b3a61bc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-124763.json b/data/2026/CVE-2026-124763.json
index 4b234de0ca..e6a0464ece 100644
--- a/data/2026/CVE-2026-124763.json
+++ b/data/2026/CVE-2026-124763.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Woocommerce Wishlist","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0)."}],"id":"CVE-2026-124763","lastModified":"2026-11-13T06:16:53.870","metrics":{},"published":"2026-11-13T06:16:53.870","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Woocommerce Wishlist","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0)."}],"id":"CVE-2026-124763","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.870","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-124822.json b/data/2026/CVE-2026-124822.json
index 956cb50184..629bd622e6 100644
--- a/data/2026/CVE-2026-124822.json
+++ b/data/2026/CVE-2026-124822.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Easy DragDrop File Uploader","vendor":"Unknown","versions":[{"lessThan":"1.1.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php."}],"id":"CVE-2026-124822","lastModified":"2026-11-13T06:16:53.960","metrics":{},"published":"2026-11-13T06:16:53.960","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/2c3537df-1312-442a-816d-904285c0e9c1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Easy DragDrop File Uploader","vendor":"Unknown","versions":[{"lessThan":"1.1.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php."}],"id":"CVE-2026-124822","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:53.960","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/2c3537df-1312-442a-816d-904285c0e9c1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-124833.json b/data/2026/CVE-2026-124833.json
index 4979ad1cdf..e382cf992b 100644
--- a/data/2026/CVE-2026-124833.json
+++ b/data/2026/CVE-2026-124833.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Ahime Image Printer","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server."}],"id":"CVE-2026-124833","lastModified":"2026-11-13T06:16:54.057","metrics":{},"published":"2026-11-13T06:16:54.057","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3b24b6d4-061c-4229-9ced-c2306eee44ea/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Ahime Image Printer","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server."}],"id":"CVE-2026-124833","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:54.057","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3b24b6d4-061c-4229-9ced-c2306eee44ea/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-124965.json b/data/2026/CVE-2026-124965.json
new file mode 100644
index 0000000000..32d937e7ab
--- /dev/null
+++ b/data/2026/CVE-2026-124965.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"buddypress-media","product":"rtMedia for WordPress, BuddyPress and bbPress","vendor":"rtCamp Inc.","versions":[{"changes":[{"at":"4.7.17","status":"unaffected"}],"lessThanOrEqual":"4.7.16","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Stored XSS.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.16."}],"id":"CVE-2026-124965","lastModified":"2026-11-13T16:17:42.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124965","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:01.597861Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:37.547","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-16-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124970.json b/data/2026/CVE-2026-124970.json
new file mode 100644
index 0000000000..0d0b4b0359
--- /dev/null
+++ b/data/2026/CVE-2026-124970.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-base-booking-of-appointments-services-and-events","product":"WP BASE Booking","vendor":"WP BASE","versions":[{"changes":[{"at":"6.6.1","status":"unaffected"}],"lessThanOrEqual":"6.5.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2."}],"id":"CVE-2026-124970","lastModified":"2026-11-13T15:17:37.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:37.683","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125077.json b/data/2026/CVE-2026-125077.json
index b535ecd0d9..8ae4840225 100644
--- a/data/2026/CVE-2026-125077.json
+++ b/data/2026/CVE-2026-125077.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"],"product":"Smart Attendance System with QR Code Scanner","vendor":"SourceCodester","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized."}],"id":"CVE-2026-125077","lastModified":"2026-11-10T00:17:06.723","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-10T00:17:06.570","references":[{"source":"cna@vuldb.com","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-05-CSRF-Student-Deletion.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125077"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041016"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433181"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433181/cti"},{"source":"cna@vuldb.com","url":"https://www.sourcecodester.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}],"source":"cna@vuldb.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"],"product":"Smart Attendance System with QR Code Scanner","vendor":"SourceCodester","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized."}],"id":"CVE-2026-125077","lastModified":"2026-11-13T15:17:37.830","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125077","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:55:21.444849Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:06.570","references":[{"source":"cna@vuldb.com","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-05-CSRF-Student-Deletion.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125077"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041016"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433181"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433181/cti"},{"source":"cna@vuldb.com","url":"https://www.sourcecodester.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125086.json b/data/2026/CVE-2026-125086.json
index dde34dc41f..145f482cff 100644
--- a/data/2026/CVE-2026-125086.json
+++ b/data/2026/CVE-2026-125086.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:d-link:m60:*:*:*:*:*:*:*:*"],"modules":["emDaemon MQTT Broker"],"product":"M60","vendor":"D-Link","versions":[{"status":"affected","version":"1.12.B01"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used."}],"id":"CVE-2026-125086","lastModified":"2026-11-10T01:17:19.810","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-10T01:17:19.640","references":[{"source":"cna@vuldb.com","url":"https://github.com/XueDugu/dlink-m60-easymesh-mqtt-credential-evidence"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125086"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1042370"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433197"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433197/cti"},{"source":"cna@vuldb.com","url":"https://www.dlink.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-259"},{"lang":"en","value":"CWE-798"}],"source":"cna@vuldb.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:d-link:m60:*:*:*:*:*:*:*:*"],"modules":["emDaemon MQTT Broker"],"product":"M60","vendor":"D-Link","versions":[{"status":"affected","version":"1.12.B01"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used."}],"id":"CVE-2026-125086","lastModified":"2026-11-13T15:17:37.987","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125086","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:56:34.756360Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:19.640","references":[{"source":"cna@vuldb.com","url":"https://github.com/XueDugu/dlink-m60-easymesh-mqtt-credential-evidence"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125086"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1042370"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433197"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433197/cti"},{"source":"cna@vuldb.com","url":"https://www.dlink.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-259"},{"lang":"en","value":"CWE-798"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125122.json b/data/2026/CVE-2026-125122.json
index f1a8a8b59e..a2b52f8894 100644
--- a/data/2026/CVE-2026-125122.json
+++ b/data/2026/CVE-2026-125122.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"compose-lint","vendor":"tmatens","versions":[{"status":"affected","version":"= 0.31.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."}],"id":"CVE-2026-125122","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T17:17:26.603","references":[{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/pull/945"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"},{"lang":"en","value":"CWE-150"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"compose-lint","vendor":"tmatens","versions":[{"status":"affected","version":"= 0.31.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."}],"id":"CVE-2026-125122","lastModified":"2026-11-13T16:17:43.487","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125122","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:25:03.488776Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:26.603","references":[{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/pull/945"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"},{"lang":"en","value":"CWE-150"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125320.json b/data/2026/CVE-2026-125320.json
index 9746cc708c..05088d3883 100644
--- a/data/2026/CVE-2026-125320.json
+++ b/data/2026/CVE-2026-125320.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"pgedge-postgres-mcp","vendor":"pgEdge","versions":[{"status":"affected","version":"< 1.1.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0."}],"id":"CVE-2026-125320","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T18:17:33.213","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/issues/231"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/pull/232"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"pgedge-postgres-mcp","vendor":"pgEdge","versions":[{"status":"affected","version":"< 1.1.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0."}],"id":"CVE-2026-125320","lastModified":"2026-11-13T16:17:44.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125320","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:31:40.892443Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:33.213","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/issues/231"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/pull/232"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125325.json b/data/2026/CVE-2026-125325.json
index 58a96dcba5..221e69c47b 100644
--- a/data/2026/CVE-2026-125325.json
+++ b/data/2026/CVE-2026-125325.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"pgedge-rag-server","vendor":"pgEdge","versions":[{"status":"affected","version":"< 2.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0."}],"id":"CVE-2026-125325","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T18:17:33.857","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/pull/44"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-488"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"pgedge-rag-server","vendor":"pgEdge","versions":[{"status":"affected","version":"< 2.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0."}],"id":"CVE-2026-125325","lastModified":"2026-11-13T16:17:45.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125325","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:33:16.391558Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:33.857","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/pull/44"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-488"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125328.json b/data/2026/CVE-2026-125328.json
index 4d7e535ec4..b505ed25b4 100644
--- a/data/2026/CVE-2026-125328.json
+++ b/data/2026/CVE-2026-125328.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"pgedge-go-llm-lib","vendor":"pgEdge","versions":[{"status":"affected","version":">= 0.1.0, < 0.2.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0."}],"id":"CVE-2026-125328","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T19:21:10.130","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/pull/26"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"},{"lang":"en","value":"CWE-522"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"pgedge-go-llm-lib","vendor":"pgEdge","versions":[{"status":"affected","version":">= 0.1.0, < 0.2.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries, and an HTTP and server-sent events proxy. From 0.1.0 until 0.2.0, GET /v1/health in llm/proxy/handlers.go uses handleHealth to ping providers with the operator's real credentials and returns their error text, while the Authorize hook in llm/proxy/proxy.go permits access by default when the consuming application does not configure it. When a provider rejects the configured credential, a remote caller who can reach the proxy can obtain part of the operator's third-party provider API key from the resulting error. This issue is fixed in version 0.2.0."}],"id":"CVE-2026-125328","lastModified":"2026-11-13T16:17:46.517","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125328","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:33:59.094273Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:10.130","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/pull/26"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"},{"lang":"en","value":"CWE-522"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125336.json b/data/2026/CVE-2026-125336.json
index 294c588723..c8a6414761 100644
--- a/data/2026/CVE-2026-125336.json
+++ b/data/2026/CVE-2026-125336.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"forge","vendor":"digitalbazaar","versions":[{"status":"affected","version":"< 1.4.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validating certificate paths. A name-constrained certificate authority with a non-critical extension can therefore issue a leaf certificate with a subjectAltName dNSName or subject commonName outside a permitted subtree or inside an excluded subtree, and node-forge accepts the chain. Exploitation requires a name-constrained CA that chains to a trusted root and either its private key or the ability to obtain an out-of-scope certificate, allowing impersonation of names outside the delegated namespace, including against forge.tls clients. Chains without nameConstraints are not affected, and affected versions safely reject critical nameConstraints as unsupported rather than accepting them. This issue is fixed in version 1.4.3."}],"id":"CVE-2026-125336","lastModified":"2026-11-10T21:46:31.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T19:21:11.393","references":[{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/commit/6b23eae8beac316b6867bdb0e7ad7c2c959a97f6"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/commit/862aa5f630bdf40b0dfda408d6ac357bf35a7d6b"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-3cc4-3294-vgjf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"forge","vendor":"digitalbazaar","versions":[{"status":"affected","version":"< 1.4.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validating certificate paths. A name-constrained certificate authority with a non-critical extension can therefore issue a leaf certificate with a subjectAltName dNSName or subject commonName outside a permitted subtree or inside an excluded subtree, and node-forge accepts the chain. Exploitation requires a name-constrained CA that chains to a trusted root and either its private key or the ability to obtain an out-of-scope certificate, allowing impersonation of names outside the delegated namespace, including against forge.tls clients. Chains without nameConstraints are not affected, and affected versions safely reject critical nameConstraints as unsupported rather than accepting them. This issue is fixed in version 1.4.3."}],"id":"CVE-2026-125336","lastModified":"2026-11-13T16:17:47.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125336","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:38:29.973125Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:11.393","references":[{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/commit/6b23eae8beac316b6867bdb0e7ad7c2c959a97f6"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/commit/862aa5f630bdf40b0dfda408d6ac357bf35a7d6b"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-3cc4-3294-vgjf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-3cc4-3294-vgjf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125340.json b/data/2026/CVE-2026-125340.json
index fd48662b2a..e6d80bec60 100644
--- a/data/2026/CVE-2026-125340.json
+++ b/data/2026/CVE-2026-125340.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"winter","vendor":"wintercms","versions":[{"status":"affected","version":">= 1.0.420, < 1.2.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a sink, including the core Editor Settings route /backend/system/settings/update/winter/backend/editor, and an unauthenticated attacker can induce an authorized backend user to follow the link. Script executing in the victim's backend origin can read the CSRF token and issue credentialed requests with that user's permissions. For the core sink, a victim with backend.manage_editor, normally a Developer-role user or superuser, can edit CMS templates, so the injected script can conditionally chain to server-side code execution; this does not grant permissions the victim lacks and does not apply automatically to every third-party plugin sink. This issue is fixed in version 1.2.14."}],"id":"CVE-2026-125340","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T20:19:08.557","references":[{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14"},{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/security/advisories/GHSA-hq84-x37p-j6q5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"winter","vendor":"wintercms","versions":[{"status":"affected","version":">= 1.0.420, < 1.2.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a sink, including the core Editor Settings route /backend/system/settings/update/winter/backend/editor, and an unauthenticated attacker can induce an authorized backend user to follow the link. Script executing in the victim's backend origin can read the CSRF token and issue credentialed requests with that user's permissions. For the core sink, a victim with backend.manage_editor, normally a Developer-role user or superuser, can edit CMS templates, so the injected script can conditionally chain to server-side code execution; this does not grant permissions the victim lacks and does not apply automatically to every third-party plugin sink. This issue is fixed in version 1.2.14."}],"id":"CVE-2026-125340","lastModified":"2026-11-13T16:17:48.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125340","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:42:01.267953Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:08.557","references":[{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14"},{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/security/advisories/GHSA-hq84-x37p-j6q5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125378.json b/data/2026/CVE-2026-125378.json
index 28faa76100..bee1b62ceb 100644
--- a/data/2026/CVE-2026-125378.json
+++ b/data/2026/CVE-2026-125378.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerDNS-Admin","vendor":"PowerDNS-Admin","versions":[{"lessThan":"2026.11.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it."}],"id":"CVE-2026-125378","lastModified":"2026-11-12T20:57:59.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:10.673","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/routes/admin.py#L1683-L1687"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/commit/baa0a19730798dfac3dd6c2bdfad8616a80bc17a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/1941"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/releases/tag/v2026.11.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/powerdns-admin-before-2026.11.0-missing-authorization-via-template-apply-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerDNS-Admin","vendor":"PowerDNS-Admin","versions":[{"lessThan":"2026.11.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it."}],"id":"CVE-2026-125378","lastModified":"2026-11-13T15:17:38.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125378","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:14:48.565167Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:10.673","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/routes/admin.py#L1683-L1687"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/commit/baa0a19730798dfac3dd6c2bdfad8616a80bc17a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/1941"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/releases/tag/v2026.11.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/powerdns-admin-before-2026.11.0-missing-authorization-via-template-apply-endpoint"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieuPenguinnn/cve-2026-125378-powerdns-admin-template-apply-missing-operator-authz"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125382.json b/data/2026/CVE-2026-125382.json
index fa610e3984..92dd582bf8 100644
--- a/data/2026/CVE-2026-125382.json
+++ b/data/2026/CVE-2026-125382.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mapos","vendor":"RamonSilva20","versions":[{"lessThan":"5.2.2","status":"affected","version":"5.0.0-beta.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users."}],"id":"CVE-2026-125382","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:11.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos"},{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos/blob/v5.2.1/application/helpers/api_helper.php#L51-L125"},{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos/commit/9a4c5dc3835b52c12616a73ab60635e96e23ad7a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos/pull/3043"},{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos/releases/tag/v5.2.2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/map-os-5.0.0-to-before-5.2.2-privilege-escalation-via-api-v1-usuarios"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mapos","vendor":"RamonSilva20","versions":[{"lessThan":"5.2.2","status":"affected","version":"5.0.0-beta.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users."}],"id":"CVE-2026-125382","lastModified":"2026-11-13T15:17:38.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125382","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:16:32.371572Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:11.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos"},{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos/blob/v5.2.1/application/helpers/api_helper.php#L51-L125"},{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos/commit/9a4c5dc3835b52c12616a73ab60635e96e23ad7a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos/pull/3043"},{"source":"disclosure@vulncheck.com","url":"https://github.com/RamonSilva20/mapos/releases/tag/v5.2.2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/map-os-5.0.0-to-before-5.2.2-privilege-escalation-via-api-v1-usuarios"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125386.json b/data/2026/CVE-2026-125386.json
index 072e59887b..c1583c455e 100644
--- a/data/2026/CVE-2026-125386.json
+++ b/data/2026/CVE-2026-125386.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"langchain4j-aideepin","vendor":"moyangzhan","versions":[{"lessThanOrEqual":"3.32.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data."}],"id":"CVE-2026-125386","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:11.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/blob/v3.32.0/server/adi-common/src/main/resources/mapper/CharacterMessageRefMemoryEmbeddingMapper.xml#L4-L10"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/commit/483499b1a6b4a27d856f85d88c28ae6152660953"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/issues/118"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/langchain4j-aideepin-through-3.32.0-idor-via-character-message-reference-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"langchain4j-aideepin","vendor":"moyangzhan","versions":[{"lessThanOrEqual":"3.32.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data."}],"id":"CVE-2026-125386","lastModified":"2026-11-13T15:17:38.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125386","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:20:35.353749Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:11.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/blob/v3.32.0/server/adi-common/src/main/resources/mapper/CharacterMessageRefMemoryEmbeddingMapper.xml#L4-L10"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/commit/483499b1a6b4a27d856f85d88c28ae6152660953"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/issues/118"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/langchain4j-aideepin-through-3.32.0-idor-via-character-message-reference-endpoints"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieuPenguinnn/cve-2026-121938-125386-langchain4j-aideepin-character-conversation-cross-user-idor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125390.json b/data/2026/CVE-2026-125390.json
index 6a525d550a..55012be9cd 100644
--- a/data/2026/CVE-2026-125390.json
+++ b/data/2026/CVE-2026-125390.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Intermesh/groupoffice","product":"Group-Office","repo":"https://github.com/Intermesh/groupoffice","vendor":"Intermesh","versions":[{"lessThan":"6.8.181","status":"affected","version":"0","versionType":"semver"},{"lessThan":"25.0.116","status":"affected","version":"25.0.0","versionType":"semver"},{"lessThan":"26.0.58","status":"affected","version":"26.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials."}],"id":"CVE-2026-125390","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:12.653","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/modules/files/controller/FolderController.php#L1550"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/commit/3c8e2104e65242b611f7d5a9a19452e369b6f28d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/commit/46b9d67e26765d9fad558c143e5d1bed45b636ac"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/commit/5fd450887af707596fb6bdffa1fa1011064460a5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/security/advisories/GHSA-pf66-g36v-7698"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-local-file-read-via-processuploadqueue"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Intermesh/groupoffice","product":"Group-Office","repo":"https://github.com/Intermesh/groupoffice","vendor":"Intermesh","versions":[{"lessThan":"6.8.181","status":"affected","version":"0","versionType":"semver"},{"lessThan":"25.0.116","status":"affected","version":"25.0.0","versionType":"semver"},{"lessThan":"26.0.58","status":"affected","version":"26.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials."}],"id":"CVE-2026-125390","lastModified":"2026-11-13T15:17:38.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125390","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:46:46.422646Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:12.653","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/modules/files/controller/FolderController.php#L1550"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/commit/3c8e2104e65242b611f7d5a9a19452e369b6f28d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/commit/46b9d67e26765d9fad558c143e5d1bed45b636ac"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/commit/5fd450887af707596fb6bdffa1fa1011064460a5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Intermesh/groupoffice/security/advisories/GHSA-pf66-g36v-7698"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-local-file-read-via-processuploadqueue"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125394.json b/data/2026/CVE-2026-125394.json
index da168c5a3c..ac3869e6fb 100644
--- a/data/2026/CVE-2026-125394.json
+++ b/data/2026/CVE-2026-125394.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/FreeRDP/FreeRDP","product":"FreeRDP","repo":"https://github.com/FreeRDP/FreeRDP","vendor":"FreeRDP","versions":[{"lessThan":"3.33.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing."}],"id":"CVE-2026-125394","lastModified":"2026-11-10T00:17:13.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:13.353","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/FreeRDP/FreeRDP/blob/3.32.2/libfreerdp/cache/brush.c#L80"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.33.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/freerdp-before-3.33.0-use-after-free-via-stale-brush-cache-pointer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/FreeRDP/FreeRDP","product":"FreeRDP","repo":"https://github.com/FreeRDP/FreeRDP","vendor":"FreeRDP","versions":[{"lessThan":"3.33.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing."}],"id":"CVE-2026-125394","lastModified":"2026-11-13T15:17:38.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125394","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:50:45.522228Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:13.353","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/FreeRDP/FreeRDP/blob/3.32.2/libfreerdp/cache/brush.c#L80"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FreeRDP/FreeRDP/commit/ffc6b976e3589b768e8e279bc61dfb7b5896e832"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.33.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/freerdp-before-3.33.0-use-after-free-via-stale-brush-cache-pointer"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125398.json b/data/2026/CVE-2026-125398.json
index 96da012347..a2bfb7edcc 100644
--- a/data/2026/CVE-2026-125398.json
+++ b/data/2026/CVE-2026-125398.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Instatic","repo":"https://github.com/CoreBunch/Instatic","vendor":"CoreBunch","versions":[{"lessThan":"0.0.21","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors."}],"id":"CVE-2026-125398","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:14.070","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/CoreBunch/Instatic/blob/v0.0.20/server/handlers/cms/data/rows.ts#L378-L398"},{"source":"disclosure@vulncheck.com","url":"https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad"},{"source":"disclosure@vulncheck.com","url":"https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21"},{"source":"disclosure@vulncheck.com","url":"https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Instatic","repo":"https://github.com/CoreBunch/Instatic","vendor":"CoreBunch","versions":[{"lessThan":"0.0.21","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors."}],"id":"CVE-2026-125398","lastModified":"2026-11-13T15:17:39.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125398","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:52:38.628802Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:14.070","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/CoreBunch/Instatic/blob/v0.0.20/server/handlers/cms/data/rows.ts#L378-L398"},{"source":"disclosure@vulncheck.com","url":"https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad"},{"source":"disclosure@vulncheck.com","url":"https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21"},{"source":"disclosure@vulncheck.com","url":"https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125406.json b/data/2026/CVE-2026-125406.json
index 39f8357807..d1432fc814 100644
--- a/data/2026/CVE-2026-125406.json
+++ b/data/2026/CVE-2026-125406.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Ettercap/ettercap","product":"ettercap","repo":"https://github.com/Ettercap/ettercap","vendor":"Ettercap","versions":[{"lessThanOrEqual":"0.8.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root."}],"id":"CVE-2026-125406","lastModified":"2026-11-12T21:07:53.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:15.507","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/dissectors/ec_telnet.c#L150-L159"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/pull/1330"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-w5ch-7c4x-crcc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-stack-buffer-underwrite-via-telnet-dissector-backspace-handling"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Ettercap/ettercap","product":"ettercap","repo":"https://github.com/Ettercap/ettercap","vendor":"Ettercap","versions":[{"lessThanOrEqual":"0.8.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root."}],"id":"CVE-2026-125406","lastModified":"2026-11-13T15:17:39.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:54:34.769856Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:15.507","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/dissectors/ec_telnet.c#L150-L159"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/pull/1330"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-w5ch-7c4x-crcc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-stack-buffer-underwrite-via-telnet-dissector-backspace-handling"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125432.json b/data/2026/CVE-2026-125432.json
new file mode 100644
index 0000000000..831040e78c
--- /dev/null
+++ b/data/2026/CVE-2026-125432.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"recaptcha-woo","product":"reCAPTCHA for WooCommerce","vendor":"RelyWP","versions":[{"changes":[{"at":"1.5.0","status":"unaffected"}],"lessThanOrEqual":"1.4.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7."}],"id":"CVE-2026-125432","lastModified":"2026-11-13T15:17:39.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:39.420","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/recaptcha-woo/vulnerability/wordpress-recaptcha-for-woocommerce-plugin-1-4-7-broken-authentication-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125440.json b/data/2026/CVE-2026-125440.json
new file mode 100644
index 0000000000..01df67b93a
--- /dev/null
+++ b/data/2026/CVE-2026-125440.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"s2member","product":"s2Member","vendor":"Cristián Lávaque","versions":[{"changes":[{"at":"261110","status":"unaffected"}],"lessThanOrEqual":"261106","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through 261106."}],"id":"CVE-2026-125440","lastModified":"2026-11-13T15:17:39.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:39.560","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/s2member/vulnerability/wordpress-s2member-plugin-261106-content-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125452.json b/data/2026/CVE-2026-125452.json
new file mode 100644
index 0000000000..4defb434d7
--- /dev/null
+++ b/data/2026/CVE-2026-125452.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wpjam-basic","product":"WPJAM Basic","vendor":"Denishua","versions":[{"changes":[{"at":"7.1.4","status":"unaffected"}],"lessThanOrEqual":"7.1.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows Reflected XSS.This issue affects WPJAM Basic: from n/a through 7.1.2."}],"id":"CVE-2026-125452","lastModified":"2026-11-13T16:17:49.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:29.351299Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:39.700","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125706.json b/data/2026/CVE-2026-125706.json
index 1b0920e4c0..ee22bfd5e9 100644
--- a/data/2026/CVE-2026-125706.json
+++ b/data/2026/CVE-2026-125706.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service."}],"id":"CVE-2026-125706","lastModified":"2026-11-12T18:17:23.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-10T12:17:18.083","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125706"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569125"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11580.patch"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0024.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service."}],"id":"CVE-2026-125706","lastModified":"2026-11-13T15:17:39.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:05:09.932598Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:18.083","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125706"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569125"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11580.patch"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0024.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125711.json b/data/2026/CVE-2026-125711.json
index fc4481d29b..f6114322f5 100644
--- a/data/2026/CVE-2026-125711.json
+++ b/data/2026/CVE-2026-125711.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Widgets for Google Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"WP Tripadvisor Review Widgets","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Booking.com Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Reviews & Recommendations","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Airbnb Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Yelp Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Amazon Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Thumbtack Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Ebay Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Zillow Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Capterra Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Expedia Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Opentable Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for WordPress Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Hotels.com Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Review Widgets for Szallas.hu","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for AliExpress Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Árukereső Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Foursquare Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Alibaba Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for SourceForge Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup)."}],"id":"CVE-2026-125711","lastModified":"2026-11-13T06:16:54.143","metrics":{},"published":"2026-11-13T06:16:54.143","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/87cbeff9-277e-48ea-b61a-53e1e2aaeed2/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Widgets for Google Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"WP Tripadvisor Review Widgets","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Booking.com Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Reviews & Recommendations","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Airbnb Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Yelp Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Amazon Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Thumbtack Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Ebay Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Zillow Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Capterra Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Expedia Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Opentable Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for WordPress Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Hotels.com Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Review Widgets for Szallas.hu","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for AliExpress Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Árukereső Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Foursquare Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for Alibaba Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Widgets for SourceForge Reviews","vendor":"Unknown","versions":[{"lessThan":"14.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup)."}],"id":"CVE-2026-125711","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:54.143","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/87cbeff9-277e-48ea-b61a-53e1e2aaeed2/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-125715.json b/data/2026/CVE-2026-125715.json
index 9838762a69..8b4e9987fd 100644
--- a/data/2026/CVE-2026-125715.json
+++ b/data/2026/CVE-2026-125715.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mTower","vendor":"Samsung Opensource","versions":[{"status":"affected","version":"97070d65ac63713b188b6e2d6bb7076d95100429"}]}],"source":"PSIRT@samsung.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke their commands, or use a close existing sessions if thier identifiers are known, The impact depends on the affected TA."}],"id":"CVE-2026-125715","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.4,"source":"PSIRT@samsung.com","type":"Secondary"}]},"published":"2026-11-10T12:17:18.760","references":[{"source":"PSIRT@samsung.com","url":"https://github.com/Samsung/mTower/commit/97070d65ac63713b188b6e2d6bb7076d95100429"}],"sourceIdentifier":"PSIRT@samsung.com","vulnStatus":"Deferred"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mTower","vendor":"Samsung Opensource","versions":[{"status":"affected","version":"97070d65ac63713b188b6e2d6bb7076d95100429"}]}],"source":"PSIRT@samsung.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke their commands, or use a close existing sessions if thier identifiers are known, The impact depends on the affected TA."}],"id":"CVE-2026-125715","lastModified":"2026-11-13T15:17:39.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.4,"source":"PSIRT@samsung.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125715","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:24.511845Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:18.760","references":[{"source":"PSIRT@samsung.com","url":"https://github.com/Samsung/mTower/commit/97070d65ac63713b188b6e2d6bb7076d95100429"}],"sourceIdentifier":"PSIRT@samsung.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-12572.json b/data/2026/CVE-2026-12572.json
index fda8c6b21e..9ae67b0315 100644
--- a/data/2026/CVE-2026-12572.json
+++ b/data/2026/CVE-2026-12572.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6201","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account."}],"id":"CVE-2026-12572","lastModified":"2026-11-10T22:19:12.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-10T12:17:19.523","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6201","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account."}],"id":"CVE-2026-12572","lastModified":"2026-11-13T15:17:45.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12572","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:26:43.776810Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:19.523","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-12573.json b/data/2026/CVE-2026-12573.json
index b78d18ac0f..1bdc97f2a9 100644
--- a/data/2026/CVE-2026-12573.json
+++ b/data/2026/CVE-2026-12573.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6201","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers."}],"id":"CVE-2026-12573","lastModified":"2026-11-10T22:19:12.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-10T12:17:19.660","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6201","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers."}],"id":"CVE-2026-12573","lastModified":"2026-11-13T15:17:45.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:26:47.910799Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:19.660","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-12574.json b/data/2026/CVE-2026-12574.json
index 353c9a5520..5491c216f6 100644
--- a/data/2026/CVE-2026-12574.json
+++ b/data/2026/CVE-2026-12574.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6201","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure."}],"id":"CVE-2026-12574","lastModified":"2026-11-10T22:19:12.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-10T12:17:19.790","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6201","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure."}],"id":"CVE-2026-12574","lastModified":"2026-11-13T15:17:46.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:26:51.163054Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:19.790","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125747.json b/data/2026/CVE-2026-125747.json
index 3565190fa0..394e5eff7f 100644
--- a/data/2026/CVE-2026-125747.json
+++ b/data/2026/CVE-2026-125747.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/easysoft/zentaopms","product":"zentaopms","repo":"https://github.com/easysoft/zentaopms","vendor":"easysoft","versions":[{"lessThanOrEqual":"22.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects."}],"id":"CVE-2026-125747","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T16:17:20.563","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/easysoft/zentaopms/blob/zentaopms_22.7_20261103/module/build/control.php#L100-L105"},{"source":"disclosure@vulncheck.com","url":"https://github.com/easysoft/zentaopms/blob/zentaopms_22.7_20261103/module/build/control.php#L211-L214"},{"source":"disclosure@vulncheck.com","url":"https://github.com/easysoft/zentaopms/issues/221"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/zentaopms-build-missing-object-authorization-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zentao-pms-through-22.7-idor-via-build-module-mutation-methods"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/easysoft/zentaopms","product":"zentaopms","repo":"https://github.com/easysoft/zentaopms","vendor":"easysoft","versions":[{"lessThanOrEqual":"22.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects."}],"id":"CVE-2026-125747","lastModified":"2026-11-13T16:17:50.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125747","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:13:41.940100Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:20.563","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/easysoft/zentaopms/blob/zentaopms_22.7_20261103/module/build/control.php#L100-L105"},{"source":"disclosure@vulncheck.com","url":"https://github.com/easysoft/zentaopms/blob/zentaopms_22.7_20261103/module/build/control.php#L211-L214"},{"source":"disclosure@vulncheck.com","url":"https://github.com/easysoft/zentaopms/issues/221"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/zentaopms-build-missing-object-authorization-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zentao-pms-through-22.7-idor-via-build-module-mutation-methods"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieund/zentaopms-build-missing-object-authorization-idor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125751.json b/data/2026/CVE-2026-125751.json
index c374fcef03..ee14a4401e 100644
--- a/data/2026/CVE-2026-125751.json
+++ b/data/2026/CVE-2026-125751.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/meteroid-oss/meteroid","product":"Meteroid","repo":"https://github.com/meteroid-oss/meteroid","vendor":"meteroid-oss","versions":[{"lessThan":"2.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash and owning tenant ID."}],"id":"CVE-2026-125751","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T16:17:21.260","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modules/meteroid/crates/meteroid-api/src/apitokens/service.rs#L78-L101"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/meteroid-before-2.2.0-cross-tenant-api-token-hash-disclosure-via-getapitokenbyid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/meteroid-oss/meteroid","product":"Meteroid","repo":"https://github.com/meteroid-oss/meteroid","vendor":"meteroid-oss","versions":[{"lessThan":"2.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash and owning tenant ID."}],"id":"CVE-2026-125751","lastModified":"2026-11-13T16:17:51.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125751","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:17:34.583365Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:21.260","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modules/meteroid/crates/meteroid-api/src/apitokens/service.rs#L78-L101"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/meteroid-before-2.2.0-cross-tenant-api-token-hash-disclosure-via-getapitokenbyid"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125755.json b/data/2026/CVE-2026-125755.json
index e7e96e6089..3d3badaecd 100644
--- a/data/2026/CVE-2026-125755.json
+++ b/data/2026/CVE-2026-125755.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/nodemailer","product":"nodemailer","vendor":"nodemailer","versions":[{"lessThan":"10.4.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity."}],"id":"CVE-2026-125755","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T16:17:22.767","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/blob/3b5cf1eec32c81f287870c8a1c9c09640062cfd5/src/addressparser/index.ts#L330-L345"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/commit/c2b9c41bb81b2294ebadd294ad15ff035a17d0a5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.4.1-recipient-allow-list-bypass-via-addressparser"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/nodemailer","product":"nodemailer","vendor":"nodemailer","versions":[{"lessThan":"10.4.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity."}],"id":"CVE-2026-125755","lastModified":"2026-11-13T16:17:52.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125755","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:20:34.361781Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:22.767","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/blob/3b5cf1eec32c81f287870c8a1c9c09640062cfd5/src/addressparser/index.ts#L330-L345"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/commit/c2b9c41bb81b2294ebadd294ad15ff035a17d0a5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.4.1-recipient-allow-list-bypass-via-addressparser"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125759.json b/data/2026/CVE-2026-125759.json
index 54316f8d7d..e6322b73c3 100644
--- a/data/2026/CVE-2026-125759.json
+++ b/data/2026/CVE-2026-125759.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/NangoHQ/nango","product":"nango","repo":"https://github.com/NangoHQ/nango","vendor":"NangoHQ","versions":[{"lessThan":"0.71.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database."}],"id":"CVE-2026-125759","lastModified":"2026-11-10T16:17:23.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T16:17:23.430","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts#L162"},{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709"},{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/pull/6867"},{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/releases/tag/v0.71.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nango-before-0.71.3-sql-injection-via-orchestrator-task-group-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/NangoHQ/nango","product":"nango","repo":"https://github.com/NangoHQ/nango","vendor":"NangoHQ","versions":[{"lessThan":"0.71.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database."}],"id":"CVE-2026-125759","lastModified":"2026-11-13T16:17:53.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125759","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:22:17.927198Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:23.430","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts#L162"},{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709"},{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/pull/6867"},{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/releases/tag/v0.71.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nango-before-0.71.3-sql-injection-via-orchestrator-task-group-key"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125783.json b/data/2026/CVE-2026-125783.json
new file mode 100644
index 0000000000..ab3d36392f
--- /dev/null
+++ b/data/2026/CVE-2026-125783.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wck-custom-fields-and-custom-post-types-creator","product":"Custom Post Types and Custom Fields creator – WCK","vendor":"madalin.ungureanu","versions":[{"changes":[{"at":"2.4.2","status":"unaffected"}],"lessThanOrEqual":"2.4.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.This issue affects Custom Post Types and Custom Fields creator – WCK: from n/a through 2.4.0."}],"id":"CVE-2026-125783","lastModified":"2026-11-13T16:17:54.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125783","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:16.594692Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:40.070","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wck-custom-fields-and-custom-post-types-creator/vulnerability/wordpress-custom-post-types-and-custom-fields-creator-wck-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125792.json b/data/2026/CVE-2026-125792.json
new file mode 100644
index 0000000000..a68da8bfd6
--- /dev/null
+++ b/data/2026/CVE-2026-125792.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"church-admin","product":"Church Admin","vendor":"Andy Moyle","versions":[{"changes":[{"at":"5.1.9","status":"unaffected"}],"lessThanOrEqual":"5.1.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8."}],"id":"CVE-2026-125792","lastModified":"2026-11-13T15:17:40.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:40.223","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-1-8-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125794.json b/data/2026/CVE-2026-125794.json
new file mode 100644
index 0000000000..c5d4ddd174
--- /dev/null
+++ b/data/2026/CVE-2026-125794.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"extensions-leaflet-map","product":"Extension for Leaflet Map","vendor":"hupe13","versions":[{"changes":[{"at":"6.1.2","status":"unaffected"}],"lessThanOrEqual":"6.1.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extension for Leaflet Map: from n/a through 6.1.1."}],"id":"CVE-2026-125794","lastModified":"2026-11-13T16:17:55.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125794","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:32.702748Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:40.373","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/extensions-leaflet-map/vulnerability/wordpress-extension-for-leaflet-map-plugin-6-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125802.json b/data/2026/CVE-2026-125802.json
new file mode 100644
index 0000000000..03b604a978
--- /dev/null
+++ b/data/2026/CVE-2026-125802.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-125802","lastModified":"2026-11-13T15:17:40.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:40.520","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125807.json b/data/2026/CVE-2026-125807.json
new file mode 100644
index 0000000000..4309f54e51
--- /dev/null
+++ b/data/2026/CVE-2026-125807.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ht-mega-for-elementor","product":"HT Mega","vendor":"HTMega","versions":[{"changes":[{"at":"3.2.9","status":"unaffected"}],"lessThanOrEqual":"3.2.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8."}],"id":"CVE-2026-125807","lastModified":"2026-11-13T15:17:40.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:40.660","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-3-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125808.json b/data/2026/CVE-2026-125808.json
new file mode 100644
index 0000000000..ec6d56b709
--- /dev/null
+++ b/data/2026/CVE-2026-125808.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ht-mega-for-elementor","product":"HT Mega","vendor":"HTMega","versions":[{"changes":[{"at":"3.2.9","status":"unaffected"}],"lessThanOrEqual":"3.2.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8."}],"id":"CVE-2026-125808","lastModified":"2026-11-13T15:17:40.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:40.807","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-3-2-8-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125809.json b/data/2026/CVE-2026-125809.json
new file mode 100644
index 0000000000..94454f0855
--- /dev/null
+++ b/data/2026/CVE-2026-125809.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mycred","product":"myCred","vendor":"myCred","versions":[{"changes":[{"at":"4.0.3","status":"unaffected"}],"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2."}],"id":"CVE-2026-125809","lastModified":"2026-11-13T16:17:56.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125809","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:39.753613Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:40.953","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125810.json b/data/2026/CVE-2026-125810.json
new file mode 100644
index 0000000000..d717e37cca
--- /dev/null
+++ b/data/2026/CVE-2026-125810.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mycred","product":"myCred","vendor":"myCred","versions":[{"changes":[{"at":"4.0.3","status":"unaffected"}],"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2."}],"id":"CVE-2026-125810","lastModified":"2026-11-13T15:17:41.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.093","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability-7?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125811.json b/data/2026/CVE-2026-125811.json
new file mode 100644
index 0000000000..57c2103a4d
--- /dev/null
+++ b/data/2026/CVE-2026-125811.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mycred","product":"myCred","vendor":"myCred","versions":[{"changes":[{"at":"4.0.3","status":"unaffected"}],"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2."}],"id":"CVE-2026-125811","lastModified":"2026-11-13T15:17:41.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.227","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125819.json b/data/2026/CVE-2026-125819.json
new file mode 100644
index 0000000000..fe468f439e
--- /dev/null
+++ b/data/2026/CVE-2026-125819.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"advanced-gutenberg","product":"Gutenberg Blocks","vendor":"PublishPress","versions":[{"changes":[{"at":"3.7.7","status":"unaffected"}],"lessThanOrEqual":"3.7.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6."}],"id":"CVE-2026-125819","lastModified":"2026-11-13T15:17:41.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.420","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-plugin-3-7-6-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125821.json b/data/2026/CVE-2026-125821.json
new file mode 100644
index 0000000000..0aa2c5cef1
--- /dev/null
+++ b/data/2026/CVE-2026-125821.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mapsvg-lite-interactive-vector-maps","product":"MapSVG","vendor":"PT Norther Lights Production","versions":[{"changes":[{"at":"9.0.5","status":"unaffected"}],"lessThanOrEqual":"9.0.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through 9.0.4."}],"id":"CVE-2026-125821","lastModified":"2026-11-13T15:17:41.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.553","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-9-0-4-content-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125824.json b/data/2026/CVE-2026-125824.json
new file mode 100644
index 0000000000..16b311adb4
--- /dev/null
+++ b/data/2026/CVE-2026-125824.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-google-maps","product":"WP Go Maps","vendor":"WP Go Maps","versions":[{"changes":[{"at":"10.1.11","status":"unaffected"}],"lessThanOrEqual":"10.1.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10."}],"id":"CVE-2026-125824","lastModified":"2026-11-13T15:17:41.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.687","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-google-maps/vulnerability/wordpress-wp-go-maps-plugin-10-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125825.json b/data/2026/CVE-2026-125825.json
new file mode 100644
index 0000000000..b627fdbee5
--- /dev/null
+++ b/data/2026/CVE-2026-125825.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"computer-repair-shop","product":"RepairBuddy","vendor":"Webful Creations","versions":[{"changes":[{"at":"4.1237","status":"unaffected"}],"lessThanOrEqual":"4.1236","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1236."}],"id":"CVE-2026-125825","lastModified":"2026-11-13T15:17:41.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.823","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1236-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125827.json b/data/2026/CVE-2026-125827.json
new file mode 100644
index 0000000000..02af70067a
--- /dev/null
+++ b/data/2026/CVE-2026-125827.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"event-tickets","product":"Event Tickets","vendor":"Liquid Web / StellarWP","versions":[{"changes":[{"at":"5.31.1","status":"unaffected"}],"lessThanOrEqual":"5.31.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0."}],"id":"CVE-2026-125827","lastModified":"2026-11-13T15:17:42.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.963","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-31-0-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125831.json b/data/2026/CVE-2026-125831.json
new file mode 100644
index 0000000000..e0464f7891
--- /dev/null
+++ b/data/2026/CVE-2026-125831.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"powerpack-addon-for-beaver-builder","product":"PowerPack Lite for Beaver Builder","vendor":"IdeaBox Creations","versions":[{"changes":[{"at":"1.3.3","status":"unaffected"}],"lessThanOrEqual":"1.3.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.2."}],"id":"CVE-2026-125831","lastModified":"2026-11-13T16:17:57.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125831","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:35.545065Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:42.140","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/powerpack-addon-for-beaver-builder/vulnerability/wordpress-powerpack-lite-for-beaver-builder-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125834.json b/data/2026/CVE-2026-125834.json
new file mode 100644
index 0000000000..3c69cb7337
--- /dev/null
+++ b/data/2026/CVE-2026-125834.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"imagify","product":"Imagify","vendor":"WP Media","versions":[{"changes":[{"at":"2.3.5","status":"unaffected"}],"lessThanOrEqual":"2.3.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4."}],"id":"CVE-2026-125834","lastModified":"2026-11-13T15:17:42.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.280","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/imagify/vulnerability/wordpress-imagify-plugin-2-3-4-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125835.json b/data/2026/CVE-2026-125835.json
new file mode 100644
index 0000000000..419c8b8de9
--- /dev/null
+++ b/data/2026/CVE-2026-125835.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://crocoblock.com","defaultStatus":"unaffected","packageName":"jet-tabs","product":"JetTabs","vendor":"Crocoblock","versions":[{"changes":[{"at":"2.3.5.1","status":"unaffected"}],"lessThanOrEqual":"2.3.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5."}],"id":"CVE-2026-125835","lastModified":"2026-11-13T15:17:42.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.417","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125837.json b/data/2026/CVE-2026-125837.json
new file mode 100644
index 0000000000..66fa9f51bd
--- /dev/null
+++ b/data/2026/CVE-2026-125837.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"make","product":"Make","vendor":"thethemefoundry","versions":[{"lessThanOrEqual":"1.10.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry Make make allows Reflected XSS.This issue affects Make: from n/a through 1.10.10."}],"id":"CVE-2026-125837","lastModified":"2026-11-13T16:17:58.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:26.244626Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:42.553","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/theme/make/vulnerability/wordpress-make-theme-1-10-10-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125851.json b/data/2026/CVE-2026-125851.json
new file mode 100644
index 0000000000..752f88f388
--- /dev/null
+++ b/data/2026/CVE-2026-125851.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"hotel-booking-lite","product":"Hotel Booking Lite","vendor":"themagnifico52","versions":[{"lessThanOrEqual":"2.5.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1."}],"id":"CVE-2026-125851","lastModified":"2026-11-13T15:17:42.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.697","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/theme/hotel-booking-lite/vulnerability/wordpress-hotel-booking-lite-theme-2-5-1-arbitrary-file-upload-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125852.json b/data/2026/CVE-2026-125852.json
new file mode 100644
index 0000000000..f060fbc8f8
--- /dev/null
+++ b/data/2026/CVE-2026-125852.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"real-estate-listing-realtyna-wpl","product":"Realtyna Organic IDX plugin","vendor":"Realtyna","versions":[{"lessThanOrEqual":"5.5.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue affects Realtyna Organic IDX plugin: from n/a through 5.5.0."}],"id":"CVE-2026-125852","lastModified":"2026-11-13T15:17:42.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.840","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-plugin-5-4-2-arbitrary-file-deletion-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125853.json b/data/2026/CVE-2026-125853.json
new file mode 100644
index 0000000000..fcff7a9be1
--- /dev/null
+++ b/data/2026/CVE-2026-125853.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"everest-backup","product":"Everest Backup","vendor":"Everestthemes","versions":[{"lessThanOrEqual":"2.3.15","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15."}],"id":"CVE-2026-125853","lastModified":"2026-11-13T15:17:43.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.983","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-plugin-2-3-14-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125854.json b/data/2026/CVE-2026-125854.json
new file mode 100644
index 0000000000..6e3e59d072
--- /dev/null
+++ b/data/2026/CVE-2026-125854.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"unbounce","product":"Unbounce Landing Pages","vendor":"Unbounce","versions":[{"lessThanOrEqual":"1.1.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unbounce Unbounce Landing Pages unbounce allows Stored XSS.This issue affects Unbounce Landing Pages: from n/a through 1.1.6."}],"id":"CVE-2026-125854","lastModified":"2026-11-13T16:17:59.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125854","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:22.667228Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:43.120","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/unbounce/vulnerability/wordpress-unbounce-landing-pages-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125855.json b/data/2026/CVE-2026-125855.json
new file mode 100644
index 0000000000..d7d5191da3
--- /dev/null
+++ b/data/2026/CVE-2026-125855.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"elex-helpdesk-customer-support-ticket-system","product":"ELEX WordPress HelpDesk & Customer Ticketing System","vendor":"Elextensions","versions":[{"changes":[{"at":"3.4.0","status":"unaffected"}],"lessThanOrEqual":"3.3.9","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9."}],"id":"CVE-2026-125855","lastModified":"2026-11-13T15:17:43.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:43.257","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/elex-helpdesk-customer-support-ticket-system/vulnerability/wordpress-elex-wordpress-helpdesk-customer-ticketing-system-plugin-3-3-9-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125856.json b/data/2026/CVE-2026-125856.json
new file mode 100644
index 0000000000..f2e0bd5e10
--- /dev/null
+++ b/data/2026/CVE-2026-125856.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"dynamic-user-directory","product":"Dynamic User Directory","vendor":"Sarah Giles","versions":[{"lessThanOrEqual":"2.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Reflected XSS.This issue affects Dynamic User Directory: from n/a through 2.4."}],"id":"CVE-2026-125856","lastModified":"2026-11-13T16:18:00.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125856","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:19.153570Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:43.403","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125858.json b/data/2026/CVE-2026-125858.json
new file mode 100644
index 0000000000..d33c85da47
--- /dev/null
+++ b/data/2026/CVE-2026-125858.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"cleverreach-wp","product":"CleverReach® WP","vendor":"CleverReach","versions":[{"lessThanOrEqual":"1.5.26","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26."}],"id":"CVE-2026-125858","lastModified":"2026-11-13T15:17:43.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:43.550","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/cleverreach-wp/vulnerability/wordpress-cleverreach-wp-plugin-1-5-26-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125880.json b/data/2026/CVE-2026-125880.json
index 2c9ff7f303..ce185404aa 100644
--- a/data/2026/CVE-2026-125880.json
+++ b/data/2026/CVE-2026-125880.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS).\n\nThis issue affects N-central: before 26.4.1."}],"id":"CVE-2026-125880","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]},"published":"2026-11-10T22:18:30.710","references":[{"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","url":"https://me.n-able.com/s/security-advisory/aArVy0000002imXKAQ/cve202612588-stored-xss-via-mms3-patch-metadata-admin-context"}],"sourceIdentifier":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-644"}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS).\n\nThis issue affects N-central: before 26.4.1."}],"id":"CVE-2026-125880","lastModified":"2026-11-13T15:17:43.693","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125880","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:34:37.063694Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:30.710","references":[{"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","url":"https://me.n-able.com/s/security-advisory/aArVy0000002imXKAQ/cve202612588-stored-xss-via-mms3-patch-metadata-admin-context"}],"sourceIdentifier":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-644"}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125881.json b/data/2026/CVE-2026-125881.json
index 74f80d257a..5b906fbf1b 100644
--- a/data/2026/CVE-2026-125881.json
+++ b/data/2026/CVE-2026-125881.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.\n\nThis issue affects N-central: before 26.4.1."}],"id":"CVE-2026-125881","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]},"published":"2026-11-10T22:18:30.860","references":[{"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","url":"https://me.n-able.com/s/security-advisory/aArVy0000002io9KAA/cve2026125881-schemahint-ssrf-via-service-import-schema-validation"}],"sourceIdentifier":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.\n\nThis issue affects N-central: before 26.4.1."}],"id":"CVE-2026-125881","lastModified":"2026-11-13T15:17:43.810","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125881","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:35:56.812579Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:30.860","references":[{"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","url":"https://me.n-able.com/s/security-advisory/aArVy0000002io9KAA/cve2026125881-schemahint-ssrf-via-service-import-schema-validation"}],"sourceIdentifier":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125882.json b/data/2026/CVE-2026-125882.json
index 4d26d3d931..87f0eeb3cf 100644
--- a/data/2026/CVE-2026-125882.json
+++ b/data/2026/CVE-2026-125882.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal vulnerability in N-able N-central allows Path Traversal.\n\nThis issue affects N-central: before 26.4.1."}],"id":"CVE-2026-125882","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]},"published":"2026-11-10T22:18:31.000","references":[{"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","url":"https://me.n-able.com/s/security-advisory/aArVy0000002iplKAA/cve2026125882-rce-via-file-repository-upload-path-traversal"}],"sourceIdentifier":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal vulnerability in N-able N-central allows Path Traversal.\n\nThis issue affects N-central: before 26.4.1."}],"id":"CVE-2026-125882","lastModified":"2026-11-13T15:17:43.927","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125882","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:35:16.668613Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:31.000","references":[{"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","url":"https://me.n-able.com/s/security-advisory/aArVy0000002iplKAA/cve2026125882-rce-via-file-repository-upload-path-traversal"}],"sourceIdentifier":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125912.json b/data/2026/CVE-2026-125912.json
index c4b3d0639f..a4a896549a 100644
--- a/data/2026/CVE-2026-125912.json
+++ b/data/2026/CVE-2026-125912.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Ultimate CSV Importer","vendor":"Unknown","versions":[{"lessThan":"9.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer  WordPress plugin before 9.2 or edit files."}],"id":"CVE-2026-125912","lastModified":"2026-11-13T06:16:54.260","metrics":{},"published":"2026-11-13T06:16:54.260","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/b7484863-c97d-49d2-b818-0308a720c556/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Ultimate CSV Importer","vendor":"Unknown","versions":[{"lessThan":"9.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer  WordPress plugin before 9.2 or edit files."}],"id":"CVE-2026-125912","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:54.260","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/b7484863-c97d-49d2-b818-0308a720c556/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-126049.json b/data/2026/CVE-2026-126049.json
index 1b76c30f2d..13c398bd53 100644
--- a/data/2026/CVE-2026-126049.json
+++ b/data/2026/CVE-2026-126049.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/aqbanking/gwenhywfar","product":"Gwenhywfar","repo":"https://github.com/aqbanking/gwenhywfar","vendor":"Martin Preuss","versions":[{"lessThan":"5.14.3","status":"affected","version":"5.14.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory."}],"id":"CVE-2026-126049","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T17:17:31.803","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/aqbanking/gwenhywfar/blob/f5c3f9dc56aa20cab85fd149885474239cf68632/src/parser/tlv.c#L651-L672"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aqbanking/gwenhywfar/commit/dc8b80945e877f5bdf2d2ae1b50c928c15e990b0"},{"source":"disclosure@vulncheck.com","url":"https://www.aquamaniac.de/rdm/projects/gwenhywfar/files"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gwenhywfar-5.14.2-use-after-free-via-gwen-tlv-buffer-to-db-nested-ber-tlv-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/aqbanking/gwenhywfar","product":"Gwenhywfar","repo":"https://github.com/aqbanking/gwenhywfar","vendor":"Martin Preuss","versions":[{"lessThan":"5.14.3","status":"affected","version":"5.14.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory."}],"id":"CVE-2026-126049","lastModified":"2026-11-13T16:18:01.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126049","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:27:41.189264Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:31.803","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/aqbanking/gwenhywfar/blob/f5c3f9dc56aa20cab85fd149885474239cf68632/src/parser/tlv.c#L651-L672"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aqbanking/gwenhywfar/commit/dc8b80945e877f5bdf2d2ae1b50c928c15e990b0"},{"source":"disclosure@vulncheck.com","url":"https://www.aquamaniac.de/rdm/projects/gwenhywfar/files"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gwenhywfar-5.14.2-use-after-free-via-gwen-tlv-buffer-to-db-nested-ber-tlv-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126063.json b/data/2026/CVE-2026-126063.json
index c0e3fe0604..500f038188 100644
--- a/data/2026/CVE-2026-126063.json
+++ b/data/2026/CVE-2026-126063.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"nokogiri","vendor":"sparklemotion","versions":[{"status":"affected","version":">= 1.12.0, < 1.19.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5."}],"id":"CVE-2026-126063","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:23.990","references":[{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/3e84df6ff7ab4d78f446e3a415430bd69a055d32"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"nokogiri","vendor":"sparklemotion","versions":[{"status":"affected","version":">= 1.12.0, < 1.19.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5."}],"id":"CVE-2026-126063","lastModified":"2026-11-13T16:18:02.683","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126063","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:49:25.822174Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:23.990","references":[{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/3e84df6ff7ab4d78f446e3a415430bd69a055d32"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126067.json b/data/2026/CVE-2026-126067.json
index 0a7286a603..3d6bb4336e 100644
--- a/data/2026/CVE-2026-126067.json
+++ b/data/2026/CVE-2026-126067.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126067","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:24.653","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126067","lastModified":"2026-11-13T16:18:03.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:56:36.588222Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:24.653","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126119.json b/data/2026/CVE-2026-126119.json
index 63aa8ba4fe..40047e22de 100644
--- a/data/2026/CVE-2026-126119.json
+++ b/data/2026/CVE-2026-126119.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Streamit","vendor":"Unknown","versions":[{"lessThan":"1.3.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution."}],"id":"CVE-2026-126119","lastModified":"2026-11-13T06:16:54.350","metrics":{},"published":"2026-11-13T06:16:54.350","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/41d42891-1170-4e84-959c-d2eec010bf7c/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Streamit","vendor":"Unknown","versions":[{"lessThan":"1.3.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution."}],"id":"CVE-2026-126119","lastModified":"2026-11-13T15:45:24.843","metrics":{},"published":"2026-11-13T06:16:54.350","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/41d42891-1170-4e84-959c-d2eec010bf7c/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"}
diff --git a/data/2026/CVE-2026-126274.json b/data/2026/CVE-2026-126274.json
index 83232125c4..1806244838 100644
--- a/data/2026/CVE-2026-126274.json
+++ b/data/2026/CVE-2026-126274.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage."}],"id":"CVE-2026-126274","lastModified":"2026-11-13T10:17:30.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:30.440","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage."}],"id":"CVE-2026-126274","lastModified":"2026-11-13T16:18:04.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126274","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:37.552966Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:30.440","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126282.json b/data/2026/CVE-2026-126282.json
index 9c0ea2bc31..782ec68906 100644
--- a/data/2026/CVE-2026-126282.json
+++ b/data/2026/CVE-2026-126282.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"2026.04.0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token."}],"id":"CVE-2026-126282","lastModified":"2026-11-13T10:17:31.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-jj94-6wwc-qhcx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-from-2026.04.0-before-2026.08.0-improper-privilege-management-via-organization-role-update"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"2026.04.0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token."}],"id":"CVE-2026-126282","lastModified":"2026-11-13T16:18:05.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126282","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:35.354163Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:31.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-jj94-6wwc-qhcx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-from-2026.04.0-before-2026.08.0-improper-privilege-management-via-organization-role-update"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126290.json b/data/2026/CVE-2026-126290.json
index c1efe603e6..779c691bf2 100644
--- a/data/2026/CVE-2026-126290.json
+++ b/data/2026/CVE-2026-126290.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.07.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.07.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials."}],"id":"CVE-2026-126290","lastModified":"2026-11-13T10:17:33.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:33.290","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-wxxj-mghf-33v4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.07.0-private-integration-credential-exposure-via-base-integration-read"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.07.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.07.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials."}],"id":"CVE-2026-126290","lastModified":"2026-11-13T16:18:06.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126290","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:47.817569Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:33.290","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-wxxj-mghf-33v4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.07.0-private-integration-credential-exposure-via-base-integration-read"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126302.json b/data/2026/CVE-2026-126302.json
index 5a8c3b7d17..44520ed4ba 100644
--- a/data/2026/CVE-2026-126302.json
+++ b/data/2026/CVE-2026-126302.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"3.9.4","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox."}],"id":"CVE-2026-126302","lastModified":"2026-11-13T10:17:35.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:35.267","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-xmfg-f9cm-w86q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-3.9.4-before-3.10.4-symlink-sandbox-escape-via-chat80-sql-query"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"3.9.4","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox."}],"id":"CVE-2026-126302","lastModified":"2026-11-13T16:18:07.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:45.468470Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:35.267","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-xmfg-f9cm-w86q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-3.9.4-before-3.10.4-symlink-sandbox-escape-via-chat80-sql-query"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126306.json b/data/2026/CVE-2026-126306.json
index 8ed5e2d2cb..ac920858be 100644
--- a/data/2026/CVE-2026-126306.json
+++ b/data/2026/CVE-2026-126306.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"espocrm","vendor":"espocrm","versions":[{"lessThan":"10.0.8","status":"affected","version":"10.0.0","versionType":"semver"},{"status":"unaffected","version":"10.0.8","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"espocrm","vendor":"espocrm","versions":[{"lessThan":"9.3.11","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"9.3.11","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator."}],"id":"CVE-2026-126306","lastModified":"2026-11-13T10:17:36.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:35.973","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-4qv5-q4g7-hp5r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/espocrm-before-10.0.8-stored-xss-via-malicious-svg-attachment"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"espocrm","vendor":"espocrm","versions":[{"lessThan":"10.0.8","status":"affected","version":"10.0.0","versionType":"semver"},{"status":"unaffected","version":"10.0.8","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"espocrm","vendor":"espocrm","versions":[{"lessThan":"9.3.11","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"9.3.11","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator."}],"id":"CVE-2026-126306","lastModified":"2026-11-13T16:18:08.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126306","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:32.944519Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:35.973","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-4qv5-q4g7-hp5r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/espocrm-before-10.0.8-stored-xss-via-malicious-svg-attachment"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126310.json b/data/2026/CVE-2026-126310.json
index 658164b161..eafb318394 100644
--- a/data/2026/CVE-2026-126310.json
+++ b/data/2026/CVE-2026-126310.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/openbao/openbao/v2","product":"openbao","vendor":"openbao","versions":[{"lessThan":"2.6.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.6.5","versionType":"semver"},{"lessThan":"2.7.2","status":"affected","version":"2.7.0","versionType":"semver"},{"status":"unaffected","version":"2.7.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret."}],"id":"CVE-2026-126310","lastModified":"2026-11-13T10:17:36.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:36.653","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openbao/openbao/security/advisories/GHSA-q824-44ff-f5j5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-oidc-provider-authentication-bypass-via-client-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/openbao/openbao/v2","product":"openbao","vendor":"openbao","versions":[{"lessThan":"2.6.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.6.5","versionType":"semver"},{"lessThan":"2.7.2","status":"affected","version":"2.7.0","versionType":"semver"},{"status":"unaffected","version":"2.7.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret."}],"id":"CVE-2026-126310","lastModified":"2026-11-13T16:18:09.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126310","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:42.686794Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:36.653","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openbao/openbao/security/advisories/GHSA-q824-44ff-f5j5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-oidc-provider-authentication-bypass-via-client-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126314.json b/data/2026/CVE-2026-126314.json
index a22642cae4..62f60f7139 100644
--- a/data/2026/CVE-2026-126314.json
+++ b/data/2026/CVE-2026-126314.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hrms","vendor":"frappe","versions":[{"lessThan":"15.64.6","status":"affected","version":"15.0.0","versionType":"semver"},{"status":"unaffected","version":"15.64.6","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"hrms","vendor":"frappe","versions":[{"lessThan":"16.20.1","status":"affected","version":"16.0.0","versionType":"semver"},{"status":"unaffected","version":"16.20.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees."}],"id":"CVE-2026-126314","lastModified":"2026-11-13T10:17:37.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:37.297","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/frappe/hrms/security/advisories/GHSA-m8m7-r43p-2jjf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.6-missing-authorization-in-bulk-record-creation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hrms","vendor":"frappe","versions":[{"lessThan":"15.64.6","status":"affected","version":"15.0.0","versionType":"semver"},{"status":"unaffected","version":"15.64.6","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"hrms","vendor":"frappe","versions":[{"lessThan":"16.20.1","status":"affected","version":"16.0.0","versionType":"semver"},{"status":"unaffected","version":"16.20.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees."}],"id":"CVE-2026-126314","lastModified":"2026-11-13T16:18:11.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126314","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:30.766203Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:37.297","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/frappe/hrms/security/advisories/GHSA-m8m7-r43p-2jjf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.6-missing-authorization-in-bulk-record-creation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126318.json b/data/2026/CVE-2026-126318.json
index ed816a3e6e..eae60341c2 100644
--- a/data/2026/CVE-2026-126318.json
+++ b/data/2026/CVE-2026-126318.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"core","vendor":"redaxo","versions":[{"lessThan":"5.21.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.21.6","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows."}],"id":"CVE-2026-126318","lastModified":"2026-11-13T10:17:37.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:37.927","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/redaxo/core/security/advisories/GHSA-6w5f-mr8f-5964"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/redaxo-before-5.21.6-authorization-bypass-of-live-version-permission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"core","vendor":"redaxo","versions":[{"lessThan":"5.21.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.21.6","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows."}],"id":"CVE-2026-126318","lastModified":"2026-11-13T16:18:12.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126318","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:40.490307Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:37.927","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/redaxo/core/security/advisories/GHSA-6w5f-mr8f-5964"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/redaxo-before-5.21.6-authorization-bypass-of-live-version-permission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126322.json b/data/2026/CVE-2026-126322.json
index 8fa83099ba..2ce4cf4b01 100644
--- a/data/2026/CVE-2026-126322.json
+++ b/data/2026/CVE-2026-126322.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patient_match_dialog.php to enumerate patients or force matches that associate lab orders with the wrong patient."}],"id":"CVE-2026-126322","lastModified":"2026-11-13T10:17:38.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:38.550","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-r52j-mq9p-mh85"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-unsanitized-deserialization-via-patient-match-dialog-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patient_match_dialog.php to enumerate patients or force matches that associate lab orders with the wrong patient."}],"id":"CVE-2026-126322","lastModified":"2026-11-13T16:18:13.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126322","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:28.271619Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:38.550","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-r52j-mq9p-mh85"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-unsanitized-deserialization-via-patient-match-dialog-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126348.json b/data/2026/CVE-2026-126348.json
index c61ce77e75..9d90a6cd7f 100644
--- a/data/2026/CVE-2026-126348.json
+++ b/data/2026/CVE-2026-126348.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.0.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text or fail to convert back to the same A-label can therefore make Addressable::URI#display_uri show a trusted-looking host while host, normalized_host, and the connection target retain the attacker-controlled encoded host. A trusted-name comparison using Addressable::IDNA.to_unicode output can also treat two different hosts as the same without displaying the URI. The native libidn implementation, to_ascii, and normalized_host are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126348","lastModified":"2026-11-13T02:18:51.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126348","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:34:06.519332Z","version":"2.0.3"}}]},"published":"2026-11-12T22:19:19.930","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-1007"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.0.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text or fail to convert back to the same A-label can therefore make Addressable::URI#display_uri show a trusted-looking host while host, normalized_host, and the connection target retain the attacker-controlled encoded host. A trusted-name comparison using Addressable::IDNA.to_unicode output can also treat two different hosts as the same without displaying the URI. The native libidn implementation, to_ascii, and normalized_host are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126348","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126348","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:34:06.519332Z","version":"2.0.3"}}]},"published":"2026-11-12T22:19:19.930","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-1007"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126349.json b/data/2026/CVE-2026-126349.json
index a07812aef8..8ccdd63c2c 100644
--- a/data/2026/CVE-2026-126349.json
+++ b/data/2026/CVE-2026-126349.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.0.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126349","lastModified":"2026-11-12T22:19:20.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.080","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-176"},{"lang":"en","value":"CWE-451"},{"lang":"en","value":"CWE-1007"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.0.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126349","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.080","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-176"},{"lang":"en","value":"CWE-451"},{"lang":"en","value":"CWE-1007"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126350.json b/data/2026/CVE-2026-126350.json
index 49c796c503..1f6c092343 100644
--- a/data/2026/CVE-2026-126350.json
+++ b/data/2026/CVE-2026-126350.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126350","lastModified":"2026-11-12T22:19:20.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/issues/364"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126350","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/issues/364"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126351.json b/data/2026/CVE-2026-126351.json
index e9117e3f2a..6fc6a0dc42 100644
--- a/data/2026/CVE-2026-126351.json
+++ b/data/2026/CVE-2026-126351.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":"< 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== inherit the behavior, so processing a sufficiently long attacker-controlled URI can consume a worker thread and cause denial of service on every Ruby implementation. URI.parse alone and code that never normalizes, compares, or joins untrusted URIs are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126351","lastModified":"2026-11-12T22:19:20.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.387","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-qq38-m9mg-xjj5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":"< 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== inherit the behavior, so processing a sufficiently long attacker-controlled URI can consume a worker thread and cause denial of service on every Ruby implementation. URI.parse alone and code that never normalizes, compares, or joins untrusted URIs are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126351","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.387","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-qq38-m9mg-xjj5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126352.json b/data/2026/CVE-2026-126352.json
index 97d508d244..c3b47f0781 100644
--- a/data/2026/CVE-2026-126352.json
+++ b/data/2026/CVE-2026-126352.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressions. Affected forms include multi-variable expressions using operators other than plus and number sign, large plus or number-sign expressions, and adjacent single-variable expressions. Template#match or Template#extract can backtrack polynomially or exponentially on attacker-controlled URIs, causing denial of service on MRI Ruby before 3.2 and JRuby, with the large plus and number-sign form also affecting MRI Ruby 3.2 and TruffleRuby 40.0. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126352","lastModified":"2026-11-13T02:18:51.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126352","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:34:59.229289Z","version":"2.0.3"}}]},"published":"2026-11-12T22:19:20.530","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/f2b27b3ab252e56b3fa3519f7ebb491d54cf7b7c"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9f42-57jx-vpp3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressions. Affected forms include multi-variable expressions using operators other than plus and number sign, large plus or number-sign expressions, and adjacent single-variable expressions. Template#match or Template#extract can backtrack polynomially or exponentially on attacker-controlled URIs, causing denial of service on MRI Ruby before 3.2 and JRuby, with the large plus and number-sign form also affecting MRI Ruby 3.2 and TruffleRuby 40.0. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126352","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126352","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:34:59.229289Z","version":"2.0.3"}}]},"published":"2026-11-12T22:19:20.530","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/f2b27b3ab252e56b3fa3519f7ebb491d54cf7b7c"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9f42-57jx-vpp3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126353.json b/data/2026/CVE-2026-126353.json
index 563a9edace..7be23c874e 100644
--- a/data/2026/CVE-2026-126353.json
+++ b/data/2026/CVE-2026-126353.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the variables in polynomially many ways. Template#match or Template#extract processing of an attacker-controlled URI can therefore consume a thread and cause denial of service. The flaw affects MRI Ruby before 3.2 and JRuby, TruffleRuby 40.0, and plus or number-sign expressions on MRI Ruby 3.2. MRI Ruby 3.3 and later, URI parsing, and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126353","lastModified":"2026-11-12T22:19:20.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.673","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/49aecf97bf6f6675717f1078a0b45f95c428e103"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-4w5q-wg7v-w6gp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the variables in polynomially many ways. Template#match or Template#extract processing of an attacker-controlled URI can therefore consume a thread and cause denial of service. The flaw affects MRI Ruby before 3.2 and JRuby, TruffleRuby 40.0, and plus or number-sign expressions on MRI Ruby 3.2. MRI Ruby 3.3 and later, URI parsing, and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126353","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.673","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/49aecf97bf6f6675717f1078a0b45f95c428e103"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-4w5q-wg7v-w6gp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126354.json b/data/2026/CVE-2026-126354.json
index 69178aaa7d..7d4952a557 100644
--- a/data/2026/CVE-2026-126354.json
+++ b/data/2026/CVE-2026-126354.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.2.5, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126354","lastModified":"2026-11-12T22:19:20.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.810","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-8gmh-2hhj-2hv9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.2.5, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126354","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.810","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-8gmh-2hhj-2hv9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126361.json b/data/2026/CVE-2026-126361.json
index 2242bfe136..1b3868691d 100644
--- a/data/2026/CVE-2026-126361.json
+++ b/data/2026/CVE-2026-126361.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"astro","vendor":"withastro","versions":[{"status":"affected","version":"< 7.4.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5."}],"id":"CVE-2026-126361","lastModified":"2026-11-13T00:20:11.587","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T00:20:11.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/pull/18520"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/releases/tag/astro@7.4.5"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/security/advisories/GHSA-mh32-jxcr-mh9f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-184"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"astro","vendor":"withastro","versions":[{"status":"affected","version":"< 7.4.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5."}],"id":"CVE-2026-126361","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T00:20:11.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/pull/18520"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/releases/tag/astro@7.4.5"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/security/advisories/GHSA-mh32-jxcr-mh9f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-184"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126371.json b/data/2026/CVE-2026-126371.json
index 805ce66e85..a743de9ccf 100644
--- a/data/2026/CVE-2026-126371.json
+++ b/data/2026/CVE-2026-126371.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Vvveb","vendor":"givanz","versions":[{"lessThanOrEqual":"1.0.8.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement."}],"id":"CVE-2026-126371","lastModified":"2026-11-13T10:17:39.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:39.230","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-ffrq-8926-cpc9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-sql-injection-via-admin-auth-tokensql-update-array-keys"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Vvveb","vendor":"givanz","versions":[{"lessThanOrEqual":"1.0.8.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement."}],"id":"CVE-2026-126371","lastModified":"2026-11-13T16:18:15.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:37.892980Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:39.230","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-ffrq-8926-cpc9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-sql-injection-via-admin-auth-tokensql-update-array-keys"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126375.json b/data/2026/CVE-2026-126375.json
index f7c3e18dc8..5397b1f221 100644
--- a/data/2026/CVE-2026-126375.json
+++ b/data/2026/CVE-2026-126375.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Vvveb","vendor":"givanz","versions":[{"lessThanOrEqual":"1.0.8.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content."}],"id":"CVE-2026-126375","lastModified":"2026-11-13T10:17:40.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:39.927","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-cross-tenant-digital-asset-tampering-via-media-trait"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Vvveb","vendor":"givanz","versions":[{"lessThanOrEqual":"1.0.8.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content."}],"id":"CVE-2026-126375","lastModified":"2026-11-13T16:18:16.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126375","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:35.463576Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:39.927","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-cross-tenant-digital-asset-tampering-via-media-trait"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126379.json b/data/2026/CVE-2026-126379.json
index 274ce267fc..7e4bbc0e67 100644
--- a/data/2026/CVE-2026-126379.json
+++ b/data/2026/CVE-2026-126379.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Vvveb","vendor":"givanz","versions":[{"lessThan":"1.0.9.0","status":"affected","version":"1.0.8.6","versionType":"custom"},{"status":"unaffected","version":"1.0.9.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials."}],"id":"CVE-2026-126379","lastModified":"2026-11-13T10:17:40.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:40.603","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vvveb-1.0.8.6-ssrf-via-oembed-proxy-dns-rebinding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Vvveb","vendor":"givanz","versions":[{"lessThan":"1.0.9.0","status":"affected","version":"1.0.8.6","versionType":"custom"},{"status":"unaffected","version":"1.0.9.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials."}],"id":"CVE-2026-126379","lastModified":"2026-11-13T16:18:17.257","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:33.225669Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:40.603","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vvveb-1.0.8.6-ssrf-via-oembed-proxy-dns-rebinding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126383.json b/data/2026/CVE-2026-126383.json
index e13ba66cde..5caaf49358 100644
--- a/data/2026/CVE-2026-126383.json
+++ b/data/2026/CVE-2026-126383.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"1.123.89","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.123.89","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.46.1","status":"affected","version":"2.46.0","versionType":"semver"},{"status":"unaffected","version":"2.46.1","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.45.5","status":"affected","version":"2.0.0","versionType":"semver"},{"status":"unaffected","version":"2.45.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"3.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database."}],"id":"CVE-2026-126383","lastModified":"2026-11-13T10:17:41.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:41.307","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/n8n-before-1.123.89-nosql-injection-via-mongodb-node-update-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"1.123.89","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.123.89","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.46.1","status":"affected","version":"2.46.0","versionType":"semver"},{"status":"unaffected","version":"2.46.1","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.45.5","status":"affected","version":"2.0.0","versionType":"semver"},{"status":"unaffected","version":"2.45.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"3.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database."}],"id":"CVE-2026-126383","lastModified":"2026-11-13T16:18:18.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126383","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:31.007922Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:41.307","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/n8n-before-1.123.89-nosql-injection-via-mongodb-node-update-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126387.json b/data/2026/CVE-2026-126387.json
index fa0a94f8d4..4be476401c 100644
--- a/data/2026/CVE-2026-126387.json
+++ b/data/2026/CVE-2026-126387.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.46.1","status":"affected","version":"2.46.0","versionType":"semver"},{"status":"unaffected","version":"2.46.1","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.45.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.45.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"3.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page."}],"id":"CVE-2026-126387","lastModified":"2026-11-13T10:17:42.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:42.030","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-9qx8-fhxv-w794"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/n8n-before-2.46.1-arbitrary-file-read-via-browser-use-browser-upload-tool"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.46.1","status":"affected","version":"2.46.0","versionType":"semver"},{"status":"unaffected","version":"2.46.1","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.45.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.45.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"3.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page."}],"id":"CVE-2026-126387","lastModified":"2026-11-13T16:18:19.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:28.555758Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:42.030","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-9qx8-fhxv-w794"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/n8n-before-2.46.1-arbitrary-file-read-via-browser-use-browser-upload-tool"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126391.json b/data/2026/CVE-2026-126391.json
index 734971fa65..5a6111a7c2 100644
--- a/data/2026/CVE-2026-126391.json
+++ b/data/2026/CVE-2026-126391.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"1.123.89","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.123.89","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.46.1","status":"affected","version":"2.46.0","versionType":"semver"},{"status":"unaffected","version":"2.46.1","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.45.5","status":"affected","version":"2.0.0","versionType":"semver"},{"status":"unaffected","version":"2.45.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"3.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host."}],"id":"CVE-2026-126391","lastModified":"2026-11-13T10:17:42.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:42.823","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/n8n-before-1.123.89-rce-via-workflow-expression-evaluation-sandbox-escape"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"1.123.89","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.123.89","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.46.1","status":"affected","version":"2.46.0","versionType":"semver"},{"status":"unaffected","version":"2.46.1","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"2.45.5","status":"affected","version":"2.0.0","versionType":"semver"},{"status":"unaffected","version":"2.45.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n-io","versions":[{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"3.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host."}],"id":"CVE-2026-126391","lastModified":"2026-11-13T16:18:20.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126391","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:25.992622Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:42.823","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/n8n-before-1.123.89-rce-via-workflow-expression-evaluation-sandbox-escape"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126399.json b/data/2026/CVE-2026-126399.json
index f6430e00ad..047a5ba0a0 100644
--- a/data/2026/CVE-2026-126399.json
+++ b/data/2026/CVE-2026-126399.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","product":"vllm","vendor":"vllm-project","versions":[{"lessThan":"0.31.0","status":"affected","version":"0.19.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion."}],"id":"CVE-2026-126399","lastModified":"2026-11-13T10:17:44.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:44.260","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vxqj-p4gw-9h4c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vllm-0.19.0-before-0.31.0-resource-exhaustion-via-request-level-num-frames"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","product":"vllm","vendor":"vllm-project","versions":[{"lessThan":"0.31.0","status":"affected","version":"0.19.0","versionType":"semver"},{"status":"unaffected","version":"0.31.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion."}],"id":"CVE-2026-126399","lastModified":"2026-11-13T16:18:21.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:26.279127Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:44.260","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vxqj-p4gw-9h4c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vllm-0.19.0-before-0.31.0-resource-exhaustion-via-request-level-num-frames"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126403.json b/data/2026/CVE-2026-126403.json
index 883bf33dbe..94c3347a14 100644
--- a/data/2026/CVE-2026-126403.json
+++ b/data/2026/CVE-2026-126403.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.38.4","status":"affected","version":"2.38.0","versionType":"semver"},{"status":"unaffected","version":"2.38.4","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.37.8","status":"affected","version":"2.37.0","versionType":"semver"},{"status":"unaffected","version":"2.37.8","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.36.11","status":"affected","version":"2.36.0","versionType":"semver"},{"status":"unaffected","version":"2.36.11","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.34.16","status":"affected","version":"2.30.0","versionType":"semver"},{"status":"unaffected","version":"2.34.16","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.29.24","status":"affected","version":"2.26.0","versionType":"semver"},{"status":"unaffected","version":"2.29.24","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.36.0","status":"affected","version":"2.35.0","versionType":"semver"},{"status":"unaffected","version":"2.36.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions."}],"id":"CVE-2026-126403","lastModified":"2026-11-13T10:17:44.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:44.910","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coder/coder/security/advisories/GHSA-9frj-7f83-x984"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.4-authorization-bypass-via-external-agent-credentials-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.38.4","status":"affected","version":"2.38.0","versionType":"semver"},{"status":"unaffected","version":"2.38.4","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.37.8","status":"affected","version":"2.37.0","versionType":"semver"},{"status":"unaffected","version":"2.37.8","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.36.11","status":"affected","version":"2.36.0","versionType":"semver"},{"status":"unaffected","version":"2.36.11","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.34.16","status":"affected","version":"2.30.0","versionType":"semver"},{"status":"unaffected","version":"2.34.16","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.29.24","status":"affected","version":"2.26.0","versionType":"semver"},{"status":"unaffected","version":"2.29.24","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.36.0","status":"affected","version":"2.35.0","versionType":"semver"},{"status":"unaffected","version":"2.36.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions."}],"id":"CVE-2026-126403","lastModified":"2026-11-13T16:18:22.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:23.703298Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:44.910","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coder/coder/security/advisories/GHSA-9frj-7f83-x984"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.4-authorization-bypass-via-external-agent-credentials-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126407.json b/data/2026/CVE-2026-126407.json
index d9d90e6a29..2d7d226978 100644
--- a/data/2026/CVE-2026-126407.json
+++ b/data/2026/CVE-2026-126407.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","product":"wasmtime","vendor":"bytecodealliance","versions":[{"lessThan":"36.0.20","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"36.0.20","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","product":"wasmtime","vendor":"bytecodealliance","versions":[{"lessThan":"48.0.8","status":"affected","version":"37.0.0","versionType":"semver"},{"status":"unaffected","version":"48.0.8","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","product":"wasmtime","vendor":"bytecodealliance","versions":[{"lessThan":"49.0.5","status":"affected","version":"49.0.0","versionType":"semver"},{"status":"unaffected","version":"49.0.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","product":"wasmtime","vendor":"bytecodealliance","versions":[{"lessThan":"50.0.1","status":"affected","version":"50.0.0","versionType":"semver"},{"status":"unaffected","version":"50.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service."}],"id":"CVE-2026-126407","lastModified":"2026-11-13T10:17:45.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:45.637","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6fr9-xmw9-5352"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wasmtime-before-36.0.20-denial-of-service-via-borrowed-resource-transfer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","product":"wasmtime","vendor":"bytecodealliance","versions":[{"lessThan":"36.0.20","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"36.0.20","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","product":"wasmtime","vendor":"bytecodealliance","versions":[{"lessThan":"48.0.8","status":"affected","version":"37.0.0","versionType":"semver"},{"status":"unaffected","version":"48.0.8","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","product":"wasmtime","vendor":"bytecodealliance","versions":[{"lessThan":"49.0.5","status":"affected","version":"49.0.0","versionType":"semver"},{"status":"unaffected","version":"49.0.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","product":"wasmtime","vendor":"bytecodealliance","versions":[{"lessThan":"50.0.1","status":"affected","version":"50.0.0","versionType":"semver"},{"status":"unaffected","version":"50.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service."}],"id":"CVE-2026-126407","lastModified":"2026-11-13T16:18:23.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:23.930509Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:45.637","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6fr9-xmw9-5352"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wasmtime-before-36.0.20-denial-of-service-via-borrowed-resource-transfer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126411.json b/data/2026/CVE-2026-126411.json
index 78328a9836..01babcdfe6 100644
--- a/data/2026/CVE-2026-126411.json
+++ b/data/2026/CVE-2026-126411.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hrms","vendor":"frappe","versions":[{"lessThan":"16.50.0","status":"affected","version":"16.0.0","versionType":"semver"},{"status":"unaffected","version":"16.50.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees."}],"id":"CVE-2026-126411","lastModified":"2026-11-13T10:17:46.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:46.380","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/frappe/hrms/security/advisories/GHSA-x3q4-g9rf-5c7r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.50.0-missing-authorization-in-hr-workflow-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hrms","vendor":"frappe","versions":[{"lessThan":"16.50.0","status":"affected","version":"16.0.0","versionType":"semver"},{"status":"unaffected","version":"16.50.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees."}],"id":"CVE-2026-126411","lastModified":"2026-11-13T16:18:24.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126411","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:21.666479Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:46.380","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/frappe/hrms/security/advisories/GHSA-x3q4-g9rf-5c7r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.50.0-missing-authorization-in-hr-workflow-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126415.json b/data/2026/CVE-2026-126415.json
index 6f7f126f35..1d687e981c 100644
--- a/data/2026/CVE-2026-126415.json
+++ b/data/2026/CVE-2026-126415.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table."}],"id":"CVE-2026-126415","lastModified":"2026-11-13T10:17:47.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:46.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-q4jf-6gcg-m3jx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-patientvalidation-module"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table."}],"id":"CVE-2026-126415","lastModified":"2026-11-13T16:18:25.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126415","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:19.342747Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:46.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-q4jf-6gcg-m3jx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-patientvalidation-module"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126419.json b/data/2026/CVE-2026-126419.json
index 739a84ffb9..c2f4eea8d7 100644
--- a/data/2026/CVE-2026-126419.json
+++ b/data/2026/CVE-2026-126419.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing."}],"id":"CVE-2026-126419","lastModified":"2026-11-13T10:17:47.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6x2w-9gwv-mc7v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-e-sign-form-submission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing."}],"id":"CVE-2026-126419","lastModified":"2026-11-13T16:18:26.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126419","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:16.858711Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:47.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6x2w-9gwv-mc7v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-e-sign-form-submission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126423.json b/data/2026/CVE-2026-126423.json
index f1be3d41f9..9c24fca17b 100644
--- a/data/2026/CVE-2026-126423.json
+++ b/data/2026/CVE-2026-126423.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable."}],"id":"CVE-2026-126423","lastModified":"2026-11-13T10:17:48.480","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.363","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pqmf-m4h6-wjh4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-zip-upload-decompression"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable."}],"id":"CVE-2026-126423","lastModified":"2026-11-13T16:18:27.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:13.820205Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:48.363","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pqmf-m4h6-wjh4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-zip-upload-decompression"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126427.json b/data/2026/CVE-2026-126427.json
index 30fcb18708..48d2800275 100644
--- a/data/2026/CVE-2026-126427.json
+++ b/data/2026/CVE-2026-126427.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds."}],"id":"CVE-2026-126427","lastModified":"2026-11-13T10:17:49.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":0.4,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.023","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-fc6f-f47r-j9x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idle-session-timeout-bypass-via-eye-exam-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds."}],"id":"CVE-2026-126427","lastModified":"2026-11-13T16:18:28.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":0.4,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:10.870766Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:49.023","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-fc6f-f47r-j9x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idle-session-timeout-bypass-via-eye-exam-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126431.json b/data/2026/CVE-2026-126431.json
index 895afa330a..f5d988a9e5 100644
--- a/data/2026/CVE-2026-126431.json
+++ b/data/2026/CVE-2026-126431.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records."}],"id":"CVE-2026-126431","lastModified":"2026-11-13T10:17:49.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.700","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8rgh-38j4-6pxf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-carecoordination-ccda-mapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records."}],"id":"CVE-2026-126431","lastModified":"2026-11-13T16:18:29.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126431","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:21.059965Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:49.700","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8rgh-38j4-6pxf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-carecoordination-ccda-mapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126435.json b/data/2026/CVE-2026-126435.json
index c18e0f2be5..a834e0c3e0 100644
--- a/data/2026/CVE-2026-126435.json
+++ b/data/2026/CVE-2026-126435.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures."}],"id":"CVE-2026-126435","lastModified":"2026-11-13T10:17:50.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-xmjf-8fc9-hh38"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-order-manifest-php-lab-order-flags"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures."}],"id":"CVE-2026-126435","lastModified":"2026-11-13T16:18:30.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126435","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:08.335864Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:50.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-xmjf-8fc9-hh38"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-order-manifest-php-lab-order-flags"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126439.json b/data/2026/CVE-2026-126439.json
index 49036f18df..0edf9210ac 100644
--- a/data/2026/CVE-2026-126439.json
+++ b/data/2026/CVE-2026-126439.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers."}],"id":"CVE-2026-126439","lastModified":"2026-11-13T10:17:51.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.987","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-7cfr-7h7r-f2x9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-c-cda-gateway-ccda-gateway-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers."}],"id":"CVE-2026-126439","lastModified":"2026-11-13T16:18:31.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126439","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:05.813167Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:50.987","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-7cfr-7h7r-f2x9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-c-cda-gateway-ccda-gateway-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126443.json b/data/2026/CVE-2026-126443.json
index 09b9270581..c8ff8a58bf 100644
--- a/data/2026/CVE-2026-126443.json
+++ b/data/2026/CVE-2026-126443.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice."}],"id":"CVE-2026-126443","lastModified":"2026-11-13T10:17:51.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.650","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-79g8-hm7q-xrh4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-dynamic-finder-ajax-php-patient-finder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice."}],"id":"CVE-2026-126443","lastModified":"2026-11-13T16:18:32.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:00.760097Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:51.650","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-79g8-hm7q-xrh4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-dynamic-finder-ajax-php-patient-finder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126447.json b/data/2026/CVE-2026-126447.json
index 14b816e16d..2449fe1039 100644
--- a/data/2026/CVE-2026-126447.json
+++ b/data/2026/CVE-2026-126447.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications."}],"id":"CVE-2026-126447","lastModified":"2026-11-13T10:17:52.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.333","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vf9m-wg38-vcc2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-trusted-messages-ajax-php-direct-messaging"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications."}],"id":"CVE-2026-126447","lastModified":"2026-11-13T16:18:33.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126447","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:56.193811Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:52.333","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vf9m-wg38-vcc2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-trusted-messages-ajax-php-direct-messaging"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126451.json b/data/2026/CVE-2026-126451.json
index 87833072e6..73ac4817e1 100644
--- a/data/2026/CVE-2026-126451.json
+++ b/data/2026/CVE-2026-126451.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints."}],"id":"CVE-2026-126451","lastModified":"2026-11-13T10:17:53.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hfpq-j3fj-cpmv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-document-template-rendering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints."}],"id":"CVE-2026-126451","lastModified":"2026-11-13T16:18:34.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126451","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:18.789189Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:52.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hfpq-j3fj-cpmv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-document-template-rendering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126455.json b/data/2026/CVE-2026-126455.json
index bd400be7a0..a88e0e9e4f 100644
--- a/data/2026/CVE-2026-126455.json
+++ b/data/2026/CVE-2026-126455.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal identities, and forge approved clinical records."}],"id":"CVE-2026-126455","lastModified":"2026-11-13T10:17:53.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/commit/71da6605dc3bcc1405ee9a65cb9f579ecbc8a1c6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vr7f-7c3w-49g7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-privilege-escalation-via-missing-authorization-and-sql-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal identities, and forge approved clinical records."}],"id":"CVE-2026-126455","lastModified":"2026-11-13T16:18:35.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:16.538512Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:53.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/commit/71da6605dc3bcc1405ee9a65cb9f579ecbc8a1c6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vr7f-7c3w-49g7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-privilege-escalation-via-missing-authorization-and-sql-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126460.json b/data/2026/CVE-2026-126460.json
index c0a1e9e98b..b9c50acf9c 100644
--- a/data/2026/CVE-2026-126460.json
+++ b/data/2026/CVE-2026-126460.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information."}],"id":"CVE-2026-126460","lastModified":"2026-11-13T10:17:54.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.337","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hqjp-rcv8-7p9c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-persistent-sql-injection-via-era-file-reprocessing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information."}],"id":"CVE-2026-126460","lastModified":"2026-11-13T16:18:36.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:53.686802Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:54.337","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hqjp-rcv8-7p9c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-persistent-sql-injection-via-era-file-reprocessing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126464.json b/data/2026/CVE-2026-126464.json
index 62fefd8967..324ea30045 100644
--- a/data/2026/CVE-2026-126464.json
+++ b/data/2026/CVE-2026-126464.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints."}],"id":"CVE-2026-126464","lastModified":"2026-11-13T10:17:55.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.077","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints."}],"id":"CVE-2026-126464","lastModified":"2026-11-13T16:18:37.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:50.299608Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:55.077","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126468.json b/data/2026/CVE-2026-126468.json
index 47020f8c67..1355240738 100644
--- a/data/2026/CVE-2026-126468.json
+++ b/data/2026/CVE-2026-126468.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing."}],"id":"CVE-2026-126468","lastModified":"2026-11-13T10:17:55.877","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.757","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6h9j-m5w9-8938"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-on-reports-and-reminder-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing."}],"id":"CVE-2026-126468","lastModified":"2026-11-13T16:18:39.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:14.126294Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:55.757","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6h9j-m5w9-8938"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-on-reports-and-reminder-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126472.json b/data/2026/CVE-2026-126472.json
index 8a22cbaafd..87932f5361 100644
--- a/data/2026/CVE-2026-126472.json
+++ b/data/2026/CVE-2026-126472.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations."}],"id":"CVE-2026-126472","lastModified":"2026-11-13T10:17:56.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6fxw-69cq-m7g6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ccdaservice-ccda-gateway-php-c-cda-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations."}],"id":"CVE-2026-126472","lastModified":"2026-11-13T16:18:40.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:11.855427Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:56.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6fxw-69cq-m7g6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ccdaservice-ccda-gateway-php-c-cda-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126476.json b/data/2026/CVE-2026-126476.json
index 81f31a2f7e..7e01efa6f7 100644
--- a/data/2026/CVE-2026-126476.json
+++ b/data/2026/CVE-2026-126476.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data."}],"id":"CVE-2026-126476","lastModified":"2026-11-13T10:17:57.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.080","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8mwp-vq82-x5mr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-auto-suggest-searchmode-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data."}],"id":"CVE-2026-126476","lastModified":"2026-11-13T16:18:41.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126476","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:47.847781Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:57.080","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8mwp-vq82-x5mr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-auto-suggest-searchmode-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126480.json b/data/2026/CVE-2026-126480.json
index b9af8c0369..c7e8fb61c3 100644
--- a/data/2026/CVE-2026-126480.json
+++ b/data/2026/CVE-2026-126480.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records."}],"id":"CVE-2026-126480","lastModified":"2026-11-13T10:17:57.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.720","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-86hf-j825-r56h"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-parameter-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records."}],"id":"CVE-2026-126480","lastModified":"2026-11-13T16:18:42.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126480","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:09.432068Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:57.720","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-86hf-j825-r56h"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-parameter-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126484.json b/data/2026/CVE-2026-126484.json
index 4389cee7eb..c551662119 100644
--- a/data/2026/CVE-2026-126484.json
+++ b/data/2026/CVE-2026-126484.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session."}],"id":"CVE-2026-126484","lastModified":"2026-11-13T10:17:58.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.423","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-c997-5w2m-grrf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-printed-fee-sheet-appointment-comments"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session."}],"id":"CVE-2026-126484","lastModified":"2026-11-13T16:18:43.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126484","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:45.472489Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:58.423","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-c997-5w2m-grrf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-printed-fee-sheet-appointment-comments"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126488.json b/data/2026/CVE-2026-126488.json
index 80e6fcc4ce..de7e6ede17 100644
--- a/data/2026/CVE-2026-126488.json
+++ b/data/2026/CVE-2026-126488.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes."}],"id":"CVE-2026-126488","lastModified":"2026-11-13T10:17:59.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.087","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-g2xw-rvhq-x543"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsitedocument-query-bitwiseand"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes."}],"id":"CVE-2026-126488","lastModified":"2026-11-13T16:18:44.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126488","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:43.032061Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:59.087","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-g2xw-rvhq-x543"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsitedocument-query-bitwiseand"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126492.json b/data/2026/CVE-2026-126492.json
index 9f3c89c495..dc991ca6ac 100644
--- a/data/2026/CVE-2026-126492.json
+++ b/data/2026/CVE-2026-126492.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL."}],"id":"CVE-2026-126492","lastModified":"2026-11-13T10:17:59.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.763","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hrf6-qx6w-vgh9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-dynamic-finder-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL."}],"id":"CVE-2026-126492","lastModified":"2026-11-13T16:18:45.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:40.673448Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:59.763","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hrf6-qx6w-vgh9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-dynamic-finder-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126792.json b/data/2026/CVE-2026-126792.json
index 0772682a62..1ae02a196a 100644
--- a/data/2026/CVE-2026-126792.json
+++ b/data/2026/CVE-2026-126792.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Libmongocrypt Driver","vendor":"MongoDB","versions":[{"lessThanOrEqual":"1.21.2","status":"affected","version":"1.1.0","versionType":"python"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the library is embedded by a caller that supplies its own cryptographic callback implementation, data larger than the buffer can be written past its end. Exploitation requires the ability to control the embedding application's in-process key-management provider configuration, a high-privilege position. The demonstrated impact is memory corruption resulting in abnormal termination of the client process."}],"id":"CVE-2026-126792","lastModified":"2026-11-13T00:20:12.877","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":4.2,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-13T00:20:12.877","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/MONGOCRYPT-975"},{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/PYTHON-5999"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"cna@mongodb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Libmongocrypt Driver","vendor":"MongoDB","versions":[{"lessThanOrEqual":"1.21.2","status":"affected","version":"1.1.0","versionType":"python"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the library is embedded by a caller that supplies its own cryptographic callback implementation, data larger than the buffer can be written past its end. Exploitation requires the ability to control the embedding application's in-process key-management provider configuration, a high-privilege position. The demonstrated impact is memory corruption resulting in abnormal termination of the client process."}],"id":"CVE-2026-126792","lastModified":"2026-11-13T16:05:40.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":4.2,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-13T00:20:12.877","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/MONGOCRYPT-975"},{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/PYTHON-5999"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126817.json b/data/2026/CVE-2026-126817.json
new file mode 100644
index 0000000000..290032ac1b
--- /dev/null
+++ b/data/2026/CVE-2026-126817.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ruby Driver","vendor":"MongoDB","versions":[{"status":"affected","version":"9.0.0","versionType":"semver"},{"status":"affected","version":"9.0.1","versionType":"semver"},{"status":"affected","version":"9.0.2","versionType":"semver"},{"status":"affected","version":"9.0.3","versionType":"semver"},{"status":"affected","version":"9.0.4","versionType":"semver"},{"status":"affected","version":"9.0.5","versionType":"semver"},{"status":"affected","version":"9.0.6","versionType":"semver"},{"status":"affected","version":"9.0.7","versionType":"semver"},{"status":"affected","version":"9.0.8","versionType":"semver"},{"status":"affected","version":"9.0.9","versionType":"semver"},{"status":"affected","version":"9.0.10","versionType":"semver"},{"status":"affected","version":"9.0.11","versionType":"semver"},{"status":"affected","version":"9.0.12","versionType":"semver"},{"status":"affected","version":"9.1.0","versionType":"semver"},{"status":"affected","version":"9.1.1","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form."}],"id":"CVE-2026-126817","lastModified":"2026-11-13T16:18:46.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-13T16:18:46.317","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/MONGOID-6037"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126818.json b/data/2026/CVE-2026-126818.json
new file mode 100644
index 0000000000..8636bdc9bc
--- /dev/null
+++ b/data/2026/CVE-2026-126818.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ruby Driver","vendor":"MongoDB","versions":[{"status":"affected","version":"9.0.0","versionType":"semver"},{"status":"affected","version":"9.0.1","versionType":"semver"},{"status":"affected","version":"9.0.2","versionType":"semver"},{"status":"affected","version":"9.0.3","versionType":"semver"},{"status":"affected","version":"9.0.4","versionType":"semver"},{"status":"affected","version":"9.0.5","versionType":"semver"},{"status":"affected","version":"9.0.6","versionType":"semver"},{"status":"affected","version":"9.0.7","versionType":"semver"},{"status":"affected","version":"9.0.8","versionType":"semver"},{"status":"affected","version":"9.0.9","versionType":"semver"},{"status":"affected","version":"9.0.10","versionType":"semver"},{"status":"affected","version":"9.0.11","versionType":"semver"},{"status":"affected","version":"9.0.12","versionType":"semver"},{"status":"affected","version":"9.1.0","versionType":"semver"},{"status":"affected","version":"9.1.1","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses class inheritance. Values the application designated for encryption are written to the database in readable form without any error or warning. A database account holding only read access to the application's collections, and no access to the encryption key store, may obtain those values."}],"id":"CVE-2026-126818","lastModified":"2026-11-13T16:18:46.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-13T16:18:46.463","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/MONGOID-6037"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-311"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126823.json b/data/2026/CVE-2026-126823.json
index f26bcded1f..3d28ac1761 100644
--- a/data/2026/CVE-2026-126823.json
+++ b/data/2026/CVE-2026-126823.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Atlas SQL JDBC Driver","vendor":"MongoDB","versions":[{"lessThanOrEqual":"4.0.1","status":"affected","version":"2.2.1","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing inside the application process, which may result in disclosure or alteration of data held by that process or in the process becoming unavailable."}],"id":"CVE-2026-126823","lastModified":"2026-11-12T22:19:21.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-12T22:19:21.100","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/SQL-3540"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-377"}],"source":"cna@mongodb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Atlas SQL JDBC Driver","vendor":"MongoDB","versions":[{"lessThanOrEqual":"4.0.1","status":"affected","version":"2.2.1","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing inside the application process, which may result in disclosure or alteration of data held by that process or in the process becoming unavailable."}],"id":"CVE-2026-126823","lastModified":"2026-11-13T16:05:40.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-12T22:19:21.100","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/SQL-3540"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-377"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126831.json b/data/2026/CVE-2026-126831.json
index 8bb78ef57a..c9a77e7cb1 100644
--- a/data/2026/CVE-2026-126831.json
+++ b/data/2026/CVE-2026-126831.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash."}],"id":"CVE-2026-126831","lastModified":"2026-11-12T18:17:28.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T18:17:28.583","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-126831"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571893"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secalert@redhat.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash."}],"id":"CVE-2026-126831","lastModified":"2026-11-13T16:18:46.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126831","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:40:33.975265Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:28.583","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-126831"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571893"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126839.json b/data/2026/CVE-2026-126839.json
index 44577f446a..b8a8ef3453 100644
--- a/data/2026/CVE-2026-126839.json
+++ b/data/2026/CVE-2026-126839.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"C# Driver","vendor":"MongoDB","versions":[{"lessThan":"3.14.0","status":"affected","version":"2.21.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required."}],"id":"CVE-2026-126839","lastModified":"2026-11-13T00:20:13.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-13T00:20:13.080","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/CSHARP-6169"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"cna@mongodb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"C# Driver","vendor":"MongoDB","versions":[{"lessThan":"3.14.0","status":"affected","version":"2.21.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required."}],"id":"CVE-2026-126839","lastModified":"2026-11-13T16:05:40.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-13T00:20:13.080","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/CSHARP-6169"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126862.json b/data/2026/CVE-2026-126862.json
index a4834fab56..4318298637 100644
--- a/data/2026/CVE-2026-126862.json
+++ b/data/2026/CVE-2026-126862.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)"}],"id":"CVE-2026-126862","lastModified":"2026-11-12T18:17:32.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:47:19.558062Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574381704"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)"}],"id":"CVE-2026-126862","lastModified":"2026-11-13T15:50:51.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:47:19.558062Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.553","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/574381704"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126863.json b/data/2026/CVE-2026-126863.json
index df3c6de0ba..e9b6bbf2d5 100644
--- a/data/2026/CVE-2026-126863.json
+++ b/data/2026/CVE-2026-126863.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126863","lastModified":"2026-11-13T05:18:29.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.687","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575312521"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126863","lastModified":"2026-11-13T15:50:39.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.687","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575312521"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126864.json b/data/2026/CVE-2026-126864.json
index e99920ba77..8650b5b2c5 100644
--- a/data/2026/CVE-2026-126864.json
+++ b/data/2026/CVE-2026-126864.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126864","lastModified":"2026-11-13T05:18:30.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126864","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.820","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567827593"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126864","lastModified":"2026-11-13T15:50:30.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126864","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.820","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/567827593"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126865.json b/data/2026/CVE-2026-126865.json
index 5b5b68c749..eaaeea2688 100644
--- a/data/2026/CVE-2026-126865.json
+++ b/data/2026/CVE-2026-126865.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126865","lastModified":"2026-11-13T05:18:30.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126865","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.960","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/573335176"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126865","lastModified":"2026-11-13T15:50:08.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126865","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.960","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/573335176"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126866.json b/data/2026/CVE-2026-126866.json
index 40292ebb1b..f301ec70b4 100644
--- a/data/2026/CVE-2026-126866.json
+++ b/data/2026/CVE-2026-126866.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}],"id":"CVE-2026-126866","lastModified":"2026-11-13T05:18:30.517","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126866","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.103","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576943246"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}],"id":"CVE-2026-126866","lastModified":"2026-11-13T15:49:14.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126866","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.103","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/576943246"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126867.json b/data/2026/CVE-2026-126867.json
index d70ffe9ea6..fc62f5d8c9 100644
--- a/data/2026/CVE-2026-126867.json
+++ b/data/2026/CVE-2026-126867.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126867","lastModified":"2026-11-13T05:18:30.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.230","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575086736"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126867","lastModified":"2026-11-13T15:48:58.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.230","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575086736"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126868.json b/data/2026/CVE-2026-126868.json
index b835e0f807..1afc6e0d47 100644
--- a/data/2026/CVE-2026-126868.json
+++ b/data/2026/CVE-2026-126868.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126868","lastModified":"2026-11-13T05:18:30.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.363","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580867734"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126868","lastModified":"2026-11-13T15:48:42.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.363","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/580867734"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126869.json b/data/2026/CVE-2026-126869.json
index f0f39fa832..33a65d9a7d 100644
--- a/data/2026/CVE-2026-126869.json
+++ b/data/2026/CVE-2026-126869.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126869","lastModified":"2026-11-13T05:18:31.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126869","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.517","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575533210"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126869","lastModified":"2026-11-13T15:48:31.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126869","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.517","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575533210"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126870.json b/data/2026/CVE-2026-126870.json
index 9ff7cd39e8..d837e1b3bf 100644
--- a/data/2026/CVE-2026-126870.json
+++ b/data/2026/CVE-2026-126870.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126870","lastModified":"2026-11-12T18:17:33.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:45:33.058730Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.647","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568906910"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126870","lastModified":"2026-11-13T15:48:18.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:45:33.058730Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.647","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/568906910"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126871.json b/data/2026/CVE-2026-126871.json
index 4e3ce81cd7..83dcb24026 100644
--- a/data/2026/CVE-2026-126871.json
+++ b/data/2026/CVE-2026-126871.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126871","lastModified":"2026-11-12T18:17:34.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:45:11.389801Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.780","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574218401"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126871","lastModified":"2026-11-13T15:48:07.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:45:11.389801Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.780","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/574218401"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126872.json b/data/2026/CVE-2026-126872.json
index 217109a9c6..a24ab2f4c0 100644
--- a/data/2026/CVE-2026-126872.json
+++ b/data/2026/CVE-2026-126872.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126872","lastModified":"2026-11-13T05:18:31.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126872","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.907","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577376424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126872","lastModified":"2026-11-13T15:47:54.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126872","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.907","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/577376424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126873.json b/data/2026/CVE-2026-126873.json
index 446c2858e5..f5dc8e2b78 100644
--- a/data/2026/CVE-2026-126873.json
+++ b/data/2026/CVE-2026-126873.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126873","lastModified":"2026-11-13T05:18:31.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126873","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.040","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577336494"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126873","lastModified":"2026-11-13T15:47:45.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126873","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.040","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/577336494"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126874.json b/data/2026/CVE-2026-126874.json
index c2dc7ac3a3..a7d68a7511 100644
--- a/data/2026/CVE-2026-126874.json
+++ b/data/2026/CVE-2026-126874.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126874","lastModified":"2026-11-13T05:18:31.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126874","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.163","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576439987"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126874","lastModified":"2026-11-13T15:46:11.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126874","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.163","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/576439987"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126875.json b/data/2026/CVE-2026-126875.json
index c8516f357a..cd6c650524 100644
--- a/data/2026/CVE-2026-126875.json
+++ b/data/2026/CVE-2026-126875.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126875","lastModified":"2026-11-12T18:17:34.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126875","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:46:49.566157Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.310","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574222006"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126875","lastModified":"2026-11-13T15:30:20.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126875","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:46:49.566157Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.310","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/574222006"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126876.json b/data/2026/CVE-2026-126876.json
index 79ec580158..a8b5833a2c 100644
--- a/data/2026/CVE-2026-126876.json
+++ b/data/2026/CVE-2026-126876.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126876","lastModified":"2026-11-13T05:18:31.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126876","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.450","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576664769"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126876","lastModified":"2026-11-13T15:29:59.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126876","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.450","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/576664769"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126885.json b/data/2026/CVE-2026-126885.json
index 5f69211d01..9ad5496d70 100644
--- a/data/2026/CVE-2026-126885.json
+++ b/data/2026/CVE-2026-126885.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126885","lastModified":"2026-11-13T05:18:32.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126885","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.650","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568699166"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126885","lastModified":"2026-11-13T15:28:04.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126885","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.650","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/568699166"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126886.json b/data/2026/CVE-2026-126886.json
index 1ef751cacf..8574ff8ab0 100644
--- a/data/2026/CVE-2026-126886.json
+++ b/data/2026/CVE-2026-126886.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126886","lastModified":"2026-11-13T05:18:33.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126886","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.780","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567611696"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126886","lastModified":"2026-11-13T15:27:04.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126886","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.780","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/567611696"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126887.json b/data/2026/CVE-2026-126887.json
index 7b4a57b1c2..b8d0431634 100644
--- a/data/2026/CVE-2026-126887.json
+++ b/data/2026/CVE-2026-126887.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126887","lastModified":"2026-11-13T05:18:33.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126887","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.907","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567611698"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126887","lastModified":"2026-11-13T15:25:55.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126887","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.907","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/567611698"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126888.json b/data/2026/CVE-2026-126888.json
index 0a7dd9bad1..71cf7bc0c2 100644
--- a/data/2026/CVE-2026-126888.json
+++ b/data/2026/CVE-2026-126888.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126888","lastModified":"2026-11-13T05:18:33.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126888","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.033","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577461556"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126888","lastModified":"2026-11-13T15:24:25.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126888","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.033","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/577461556"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126889.json b/data/2026/CVE-2026-126889.json
index df684a56e8..9c164e0663 100644
--- a/data/2026/CVE-2026-126889.json
+++ b/data/2026/CVE-2026-126889.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126889","lastModified":"2026-11-13T05:18:33.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126889","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.180","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/560620348"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126889","lastModified":"2026-11-13T15:23:30.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126889","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.180","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/560620348"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126890.json b/data/2026/CVE-2026-126890.json
index 0770e3e323..3f77267271 100644
--- a/data/2026/CVE-2026-126890.json
+++ b/data/2026/CVE-2026-126890.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126890","lastModified":"2026-11-13T05:18:34.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126890","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.307","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581629247"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126890","lastModified":"2026-11-13T15:19:43.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126890","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.307","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/581629247"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126892.json b/data/2026/CVE-2026-126892.json
index c5b6d3bd5d..67c954d9d1 100644
--- a/data/2026/CVE-2026-126892.json
+++ b/data/2026/CVE-2026-126892.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126892","lastModified":"2026-11-13T05:18:34.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.617","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656065"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126892","lastModified":"2026-11-13T15:17:41.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.617","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/578656065"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126893.json b/data/2026/CVE-2026-126893.json
index d43e163267..7835221872 100644
--- a/data/2026/CVE-2026-126893.json
+++ b/data/2026/CVE-2026-126893.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126893","lastModified":"2026-11-13T05:18:34.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.760","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579278668"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126893","lastModified":"2026-11-13T15:16:40.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.760","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/579278668"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126895.json b/data/2026/CVE-2026-126895.json
index b179a11d61..eb0b188128 100644
--- a/data/2026/CVE-2026-126895.json
+++ b/data/2026/CVE-2026-126895.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126895","lastModified":"2026-11-13T05:18:34.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126895","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.020","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575524700"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126895","lastModified":"2026-11-13T15:46:01.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126895","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.020","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575524700"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126902.json b/data/2026/CVE-2026-126902.json
index feab852bf0..70198243ef 100644
--- a/data/2026/CVE-2026-126902.json
+++ b/data/2026/CVE-2026-126902.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126902","lastModified":"2026-11-13T05:18:36.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126902","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.000","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580867480"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126902","lastModified":"2026-11-13T15:44:51.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126902","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.000","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/580867480"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126915.json b/data/2026/CVE-2026-126915.json
index dce102e9ce..b2bbe492f5 100644
--- a/data/2026/CVE-2026-126915.json
+++ b/data/2026/CVE-2026-126915.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126915","lastModified":"2026-11-13T05:18:37.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126915","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:21.800","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579276256"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-457"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126915","lastModified":"2026-11-13T15:44:16.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126915","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:21.800","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/579276256"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-457"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126922.json b/data/2026/CVE-2026-126922.json
index 7efe216bac..9542ed9790 100644
--- a/data/2026/CVE-2026-126922.json
+++ b/data/2026/CVE-2026-126922.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126922","lastModified":"2026-11-12T18:17:38.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126922","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:30:20.895084Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.800","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577341943"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126922","lastModified":"2026-11-13T15:43:58.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126922","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:30:20.895084Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.800","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/577341943"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126937.json b/data/2026/CVE-2026-126937.json
index ef51e9ef96..9348db2eb2 100644
--- a/data/2026/CVE-2026-126937.json
+++ b/data/2026/CVE-2026-126937.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.6.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.6.5","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance."}],"id":"CVE-2026-126937","lastModified":"2026-11-13T10:18:00.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:00.417","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-wgjv-p9mm-qw77"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.6.5-toctou-race-condition-via-api-setup"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.6.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.6.5","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance."}],"id":"CVE-2026-126937","lastModified":"2026-11-13T16:18:47.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126937","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:07.043773Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:00.417","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-wgjv-p9mm-qw77"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.6.5-toctou-race-condition-via-api-setup"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126941.json b/data/2026/CVE-2026-126941.json
index 6e83cee80d..1e29e7630f 100644
--- a/data/2026/CVE-2026-126941.json
+++ b/data/2026/CVE-2026-126941.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders."}],"id":"CVE-2026-126941","lastModified":"2026-11-13T10:18:01.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:01.023","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.6.2-privilege-escalation-via-missing-role-checks-on-user-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders."}],"id":"CVE-2026-126941","lastModified":"2026-11-13T16:18:48.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126941","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:38.336434Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:01.023","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.6.2-privilege-escalation-via-missing-role-checks-on-user-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126945.json b/data/2026/CVE-2026-126945.json
index 8a47a21a75..217e36e6d8 100644
--- a/data/2026/CVE-2026-126945.json
+++ b/data/2026/CVE-2026-126945.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.5.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.5.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf."}],"id":"CVE-2026-126945","lastModified":"2026-11-13T10:18:01.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:01.600","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-m649-gvwx-j6qv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.5.1-stored-xss-via-highlightcode-component"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.5.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.5.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf."}],"id":"CVE-2026-126945","lastModified":"2026-11-13T16:18:49.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126945","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:04.774804Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:01.600","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-m649-gvwx-j6qv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.5.1-stored-xss-via-highlightcode-component"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126946.json b/data/2026/CVE-2026-126946.json
index 07da282832..a7e5a9549f 100644
--- a/data/2026/CVE-2026-126946.json
+++ b/data/2026/CVE-2026-126946.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.5.0","status":"affected","version":"4.3.0","versionType":"semver"},{"status":"unaffected","version":"4.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages."}],"id":"CVE-2026-126946","lastModified":"2026-11-13T10:18:01.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:01.747","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-9j96-vvqc-h9f8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-4.3.0-before-4.5.0-stored-xss-via-ssr-embed-meta-tags"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.5.0","status":"affected","version":"4.3.0","versionType":"semver"},{"status":"unaffected","version":"4.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages."}],"id":"CVE-2026-126946","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:01.747","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-9j96-vvqc-h9f8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-4.3.0-before-4.5.0-stored-xss-via-ssr-embed-meta-tags"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126947.json b/data/2026/CVE-2026-126947.json
index f1158eba7c..a687af465e 100644
--- a/data/2026/CVE-2026-126947.json
+++ b/data/2026/CVE-2026-126947.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages."}],"id":"CVE-2026-126947","lastModified":"2026-11-13T10:18:01.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:01.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-6q69-pgmp-w93c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.5.0-stored-open-redirect-via-post-api-user-urls"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages."}],"id":"CVE-2026-126947","lastModified":"2026-11-13T16:18:51.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126947","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:35.972472Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:01.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-6q69-pgmp-w93c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.5.0-stored-open-redirect-via-post-api-user-urls"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126948.json b/data/2026/CVE-2026-126948.json
index e7c1c45ec2..48a4cd3b55 100644
--- a/data/2026/CVE-2026-126948.json
+++ b/data/2026/CVE-2026-126948.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/zipline","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it."}],"id":"CVE-2026-126948","lastModified":"2026-11-13T10:18:02.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.047","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-fgwh-2pc5-wr73"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.5.0-idor-via-folder-patch-and-delete-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/zipline","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it."}],"id":"CVE-2026-126948","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.047","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-fgwh-2pc5-wr73"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.5.0-idor-via-folder-patch-and-delete-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126949.json b/data/2026/CVE-2026-126949.json
index da336aa5ca..8a41330c4b 100644
--- a/data/2026/CVE-2026-126949.json
+++ b/data/2026/CVE-2026-126949.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents."}],"id":"CVE-2026-126949","lastModified":"2026-11-13T10:18:02.193","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.193","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-rw9m-7mvm-6gxp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-file-overwrite-via-patch-api-user-files-id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents."}],"id":"CVE-2026-126949","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.193","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-rw9m-7mvm-6gxp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-file-overwrite-via-patch-api-user-files-id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126950.json b/data/2026/CVE-2026-126950.json
index 7011233038..e5f39e70e4 100644
--- a/data/2026/CVE-2026-126950.json
+++ b/data/2026/CVE-2026-126950.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss."}],"id":"CVE-2026-126950","lastModified":"2026-11-13T10:18:02.323","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.323","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-2wfm-prg7-x586"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-arbitrary-file-delete-via-x-zipline-file-extension"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss."}],"id":"CVE-2026-126950","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.323","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-2wfm-prg7-x586"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-arbitrary-file-delete-via-x-zipline-file-extension"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126951.json b/data/2026/CVE-2026-126951.json
index e37a7266f2..1f065455ac 100644
--- a/data/2026/CVE-2026-126951.json
+++ b/data/2026/CVE-2026-126951.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow."}],"id":"CVE-2026-126951","lastModified":"2026-11-13T10:18:02.460","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.460","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-8xjg-qm2p-75gm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-authenticated-path-traversal-via-api-user-files-id-raw"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow."}],"id":"CVE-2026-126951","lastModified":"2026-11-13T16:18:52.350","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126951","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:33.718774Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:02.460","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-8xjg-qm2p-75gm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-authenticated-path-traversal-via-api-user-files-id-raw"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126952.json b/data/2026/CVE-2026-126952.json
index 57954f9b89..10c6f6445b 100644
--- a/data/2026/CVE-2026-126952.json
+++ b/data/2026/CVE-2026-126952.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts."}],"id":"CVE-2026-126952","lastModified":"2026-11-13T10:18:02.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.590","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-webauthn-authentication-bypass-via-passkey-login"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts."}],"id":"CVE-2026-126952","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.590","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.4.0-webauthn-authentication-bypass-via-passkey-login"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126954.json b/data/2026/CVE-2026-126954.json
index b6d8c2e134..9d251b8078 100644
--- a/data/2026/CVE-2026-126954.json
+++ b/data/2026/CVE-2026-126954.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/glanceapp/glance","product":"glance","repo":"https://github.com/glanceapp/glance","vendor":"glanceapp","versions":[{"lessThan":"0.8.8","status":"affected","version":"0.7.9","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content."}],"id":"CVE-2026-126954","lastModified":"2026-11-13T10:18:02.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.897","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/templates/widget-base.html#L5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/widget-extension.go#L151-L152"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/releases/tag/v0.8.8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/security/advisories/GHSA-96x7-3hwp-rcfc"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/security/advisories/GHSA-f2c4-p935-ffpj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/glance-0.7.9-before-0.8.8-stored-xss-via-widget-title-url-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/glanceapp/glance","product":"glance","repo":"https://github.com/glanceapp/glance","vendor":"glanceapp","versions":[{"lessThan":"0.8.8","status":"affected","version":"0.7.9","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content."}],"id":"CVE-2026-126954","lastModified":"2026-11-13T15:53:39.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:02.897","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/templates/widget-base.html#L5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/widget-extension.go#L151-L152"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/releases/tag/v0.8.8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/security/advisories/GHSA-96x7-3hwp-rcfc"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/security/advisories/GHSA-f2c4-p935-ffpj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/glance-0.7.9-before-0.8.8-stored-xss-via-widget-title-url-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126955.json b/data/2026/CVE-2026-126955.json
index a24a12e7af..fe175be854 100644
--- a/data/2026/CVE-2026-126955.json
+++ b/data/2026/CVE-2026-126955.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/glanceapp/glance","product":"glance","repo":"https://github.com/glanceapp/glance","vendor":"glanceapp","versions":[{"lessThan":"0.8.8","status":"affected","version":"0.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names."}],"id":"CVE-2026-126955","lastModified":"2026-11-13T10:18:03.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.060","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/releases/tag/v0.8.8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-204"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/glanceapp/glance","product":"glance","repo":"https://github.com/glanceapp/glance","vendor":"glanceapp","versions":[{"lessThan":"0.8.8","status":"affected","version":"0.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names."}],"id":"CVE-2026-126955","lastModified":"2026-11-13T15:53:39.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.060","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/releases/tag/v0.8.8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-204"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126982.json b/data/2026/CVE-2026-126982.json
index 442201ea89..333dad4f19 100644
--- a/data/2026/CVE-2026-126982.json
+++ b/data/2026/CVE-2026-126982.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"C# Driver","vendor":"MongoDB","versions":[{"lessThan":"3.14.0","status":"affected","version":"3.2.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later deserializes can cause the application process to instantiate .NET types outside the intended allow-list and populate them with unauthorized party-controlled values. In applications that contain a suitable gadget type, this can lead to arbitrary code execution in the context of the application, with corresponding loss of confidentiality, integrity, and availability. No special privileges beyond the ability to introduce data the application reads are required."}],"id":"CVE-2026-126982","lastModified":"2026-11-13T00:20:13.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-13T00:20:13.250","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/CSHARP-6160"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"cna@mongodb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"C# Driver","vendor":"MongoDB","versions":[{"lessThan":"3.14.0","status":"affected","version":"3.2.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later deserializes can cause the application process to instantiate .NET types outside the intended allow-list and populate them with unauthorized party-controlled values. In applications that contain a suitable gadget type, this can lead to arbitrary code execution in the context of the application, with corresponding loss of confidentiality, integrity, and availability. No special privileges beyond the ability to introduce data the application reads are required."}],"id":"CVE-2026-126982","lastModified":"2026-11-13T16:05:40.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-13T00:20:13.250","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/CSHARP-6160"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127031.json b/data/2026/CVE-2026-127031.json
new file mode 100644
index 0000000000..44e306ea19
--- /dev/null
+++ b/data/2026/CVE-2026-127031.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse AAS Model for Java (Eclipse AAS4J)","vendor":"Eclipse Foundation","versions":[{"lessThan":"3.0.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls it) validates untrusted XML with a default JAXP `Validator` that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read local files from the host, send their contents out-of-band to an attacker-controlled server, and make the validating process send arbitrary outbound requests (SSRF). Validation still returns no errors.\n\n\n\nDetails:\n\n\n\n- Vulnerable code: `dataformat-xml/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/XmlSchemaValidator.java`. `schema.newValidator().validate(new StreamSource(...))` runs without `ACCESS_EXTERNAL_DTD` / `ACCESS_EXTERNAL_SCHEMA` restrictions and without `disallow-doctype-decl`.\n\n\n\n- Second entry point: `dataformat-aasx/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/AASXValidator.java`. The AAS XML part of an `.aasx` package is passed unchanged to the vulnerable validator.\n\n\n\n- `XmlDeserializer` (Jackson/Woodstox) is not affected, because DTD support is disabled by default there.\n\n\n\n- Present since the initial import of the code base (commit `cc9da52`).\n\n\n\n- Fix: harden the validator by setting `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_SCHEMA` to `\"\"` and rejecting `DOCTYPE` declarations. The bundled `AAS.xsd` does not need DTDs, so no functionality is lost."}],"id":"CVE-2026-127031","lastModified":"2026-11-13T15:17:44.043","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-13T15:17:44.043","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-aas4j/aas4j"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-aas4j/aas4j/blob/main/dataformat-xml/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/XmlSchemaValidator.java"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/571"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received"}
diff --git a/data/2026/CVE-2026-127073.json b/data/2026/CVE-2026-127073.json
index 021d0af186..7834a09981 100644
--- a/data/2026/CVE-2026-127073.json
+++ b/data/2026/CVE-2026-127073.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets."}],"id":"CVE-2026-127073","lastModified":"2026-11-13T10:18:03.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.200","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/7bc715e190e5be2c2fc5be15c4035ce7"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-privilege-escalation-via-additional-manifest"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets."}],"id":"CVE-2026-127073","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.200","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/7bc715e190e5be2c2fc5be15c4035ce7"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-privilege-escalation-via-additional-manifest"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127074.json b/data/2026/CVE-2026-127074.json
index fab7479d19..f01c3ab982 100644
--- a/data/2026/CVE-2026-127074.json
+++ b/data/2026/CVE-2026-127074.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log."}],"id":"CVE-2026-127074","lastModified":"2026-11-13T10:18:03.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.380","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/58e88fa3decf9e0145bf28a4b61a394a"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-dockerfile-path-and-build-context"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log."}],"id":"CVE-2026-127074","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.380","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/58e88fa3decf9e0145bf28a4b61a394a"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-dockerfile-path-and-build-context"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127075.json b/data/2026/CVE-2026-127075.json
index 862c6e9962..57eed86332 100644
--- a/data/2026/CVE-2026-127075.json
+++ b/data/2026/CVE-2026-127075.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens."}],"id":"CVE-2026-127075","lastModified":"2026-11-13T10:18:03.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.530","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/ce44dc92c964b43008eb714343e4de82"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-additional-manifest-rendering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens."}],"id":"CVE-2026-127075","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.530","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/ce44dc92c964b43008eb714343e4de82"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-additional-manifest-rendering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127076.json b/data/2026/CVE-2026-127076.json
index f7e7971746..34b754f742 100644
--- a/data/2026/CVE-2026-127076.json
+++ b/data/2026/CVE-2026-127076.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets."}],"id":"CVE-2026-127076","lastModified":"2026-11-13T10:18:03.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.680","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/2c7f64bebb810f565223b6916551df36"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-broken-access-control-via-git-repo-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets."}],"id":"CVE-2026-127076","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.680","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/2c7f64bebb810f565223b6916551df36"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-broken-access-control-via-git-repo-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127077.json b/data/2026/CVE-2026-127077.json
index a7105eb2bd..25d86a5035 100644
--- a/data/2026/CVE-2026-127077.json
+++ b/data/2026/CVE-2026-127077.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation."}],"id":"CVE-2026-127077","lastModified":"2026-11-13T10:18:03.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.820","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/e6ba937a2ea3f06fc0a79bd6193e4574"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-environment-creation-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation."}],"id":"CVE-2026-127077","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.820","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/e6ba937a2ea3f06fc0a79bd6193e4574"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-environment-creation-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127078.json b/data/2026/CVE-2026-127078.json
index 63070db165..9e1ac50de4 100644
--- a/data/2026/CVE-2026-127078.json
+++ b/data/2026/CVE-2026-127078.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure."}],"id":"CVE-2026-127078","lastModified":"2026-11-13T10:18:03.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.970","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/26f637bfda3513ab255d8f8e46bcf8d1"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-project-env-id-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure."}],"id":"CVE-2026-127078","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.970","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/26f637bfda3513ab255d8f8e46bcf8d1"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-project-env-id-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127079.json b/data/2026/CVE-2026-127079.json
index bc09806d49..a54456189a 100644
--- a/data/2026/CVE-2026-127079.json
+++ b/data/2026/CVE-2026-127079.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account."}],"id":"CVE-2026-127079","lastModified":"2026-11-13T10:18:04.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.113","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/c3c9d02c324a73937ca4db81f223435e"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-otp-brute-force-via-password-reset-check-otp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account."}],"id":"CVE-2026-127079","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.113","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/c3c9d02c324a73937ca4db81f223435e"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-otp-brute-force-via-password-reset-check-otp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127080.json b/data/2026/CVE-2026-127080.json
index 4de5768648..6b5d49fc29 100644
--- a/data/2026/CVE-2026-127080.json
+++ b/data/2026/CVE-2026-127080.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise."}],"id":"CVE-2026-127080","lastModified":"2026-11-13T10:18:04.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.260","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/b8c1cf47f829c28086fe78d8187eb938"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-container-escape-via-unrestricted-hostpath-volumes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise."}],"id":"CVE-2026-127080","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.260","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/b8c1cf47f829c28086fe78d8187eb938"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-container-escape-via-unrestricted-hostpath-volumes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127081.json b/data/2026/CVE-2026-127081.json
index 786404f0c4..2687324dac 100644
--- a/data/2026/CVE-2026-127081.json
+++ b/data/2026/CVE-2026-127081.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation."}],"id":"CVE-2026-127081","lastModified":"2026-11-13T10:18:04.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.403","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/0f4aaf3d9ab99950c7f643546fd7d713"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-pipeline-stage-project-env-id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation."}],"id":"CVE-2026-127081","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.403","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/0f4aaf3d9ab99950c7f643546fd7d713"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-pipeline-stage-project-env-id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127082.json b/data/2026/CVE-2026-127082.json
index c3dbbc0fff..bce5455891 100644
--- a/data/2026/CVE-2026-127082.json
+++ b/data/2026/CVE-2026-127082.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/huginn/huginn","product":"huginn","repo":"https://github.com/huginn/huginn","vendor":"huginn","versions":[{"lessThan":"2026.11.09","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets."}],"id":"CVE-2026-127082","lastModified":"2026-11-13T10:18:04.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.550","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jq_agent.rb#L166"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/commit/826f4bd471c027660b1951408b44f9e5c5452aff"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/releases/tag/v2026.11.09"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/security/advisories/GHSA-3f56-748g-q34j"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/huginn-before-2026.11.09-information-exposure-via-jqagent-jq-env-builtin"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/huginn/huginn","product":"huginn","repo":"https://github.com/huginn/huginn","vendor":"huginn","versions":[{"lessThan":"2026.11.09","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets."}],"id":"CVE-2026-127082","lastModified":"2026-11-13T15:53:39.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.550","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jq_agent.rb#L166"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/commit/826f4bd471c027660b1951408b44f9e5c5452aff"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/releases/tag/v2026.11.09"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/security/advisories/GHSA-3f56-748g-q34j"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/huginn-before-2026.11.09-information-exposure-via-jqagent-jq-env-builtin"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127083.json b/data/2026/CVE-2026-127083.json
index 13b35f4df4..86e98b65ea 100644
--- a/data/2026/CVE-2026-127083.json
+++ b/data/2026/CVE-2026-127083.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/huginn/huginn","product":"huginn","repo":"https://github.com/huginn/huginn","vendor":"huginn","versions":[{"lessThan":"2026.11.09","status":"affected","version":"2026.09.09","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events."}],"id":"CVE-2026-127083","lastModified":"2026-11-13T10:18:04.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.697","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jira_agent.rb#L108-L109"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/blob/v2026.11.05.2/lib/outbound_proxy.rb#L38-L42"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/commit/a6f5fb64ac957f33fc6cdff6ab92884e372857a8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/releases/tag/v2026.11.09"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/security/advisories/GHSA-98rv-h5p4-9rgr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/huginn-from-2026.09.09-before-2026.11.09-ssrf-via-outbound-proxy-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/huginn/huginn","product":"huginn","repo":"https://github.com/huginn/huginn","vendor":"huginn","versions":[{"lessThan":"2026.11.09","status":"affected","version":"2026.09.09","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events."}],"id":"CVE-2026-127083","lastModified":"2026-11-13T15:53:39.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.697","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jira_agent.rb#L108-L109"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/blob/v2026.11.05.2/lib/outbound_proxy.rb#L38-L42"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/commit/a6f5fb64ac957f33fc6cdff6ab92884e372857a8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/releases/tag/v2026.11.09"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huginn/huginn/security/advisories/GHSA-98rv-h5p4-9rgr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/huginn-from-2026.09.09-before-2026.11.09-ssrf-via-outbound-proxy-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127084.json b/data/2026/CVE-2026-127084.json
index 2ae6d6ade0..5329a626eb 100644
--- a/data/2026/CVE-2026-127084.json
+++ b/data/2026/CVE-2026-127084.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/teableio/teable","product":"teable","repo":"https://github.com/teableio/teable","vendor":"teableio","versions":[{"lessThan":"2026-10-12T12-45-53Z.3331","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions."}],"id":"CVE-2026-127084","lastModified":"2026-11-13T10:18:04.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.853","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/teableio/teable/blob/5ef2238883cad7c3980084de9a9031135fb9734f/apps/nestjs-backend/src/features/attachments/attachments.controller.ts#L52-L71"},{"source":"disclosure@vulncheck.com","url":"https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304"},{"source":"disclosure@vulncheck.com","url":"https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.3331"},{"source":"disclosure@vulncheck.com","url":"https://github.com/teableio/teable/security/advisories/GHSA-2fm5-fcfx-hq5f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-stored-xss-via-attachment-uploads"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/teableio/teable","product":"teable","repo":"https://github.com/teableio/teable","vendor":"teableio","versions":[{"lessThan":"2026-10-12T12-45-53Z.3331","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions."}],"id":"CVE-2026-127084","lastModified":"2026-11-13T16:18:53.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:01.553879Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:04.853","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/teableio/teable/blob/5ef2238883cad7c3980084de9a9031135fb9734f/apps/nestjs-backend/src/features/attachments/attachments.controller.ts#L52-L71"},{"source":"disclosure@vulncheck.com","url":"https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304"},{"source":"disclosure@vulncheck.com","url":"https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.3331"},{"source":"disclosure@vulncheck.com","url":"https://github.com/teableio/teable/security/advisories/GHSA-2fm5-fcfx-hq5f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-stored-xss-via-attachment-uploads"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127085.json b/data/2026/CVE-2026-127085.json
index c58bcbf0d0..d04d34eb51 100644
--- a/data/2026/CVE-2026-127085.json
+++ b/data/2026/CVE-2026-127085.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/IgnisDa/ryot","product":"ryot","repo":"https://github.com/IgnisDa/ryot","vendor":"IgnisDa","versions":[{"lessThan":"10.5.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users."}],"id":"CVE-2026-127085","lastModified":"2026-11-13T10:18:05.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.010","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/IgnisDa/ryot","product":"ryot","repo":"https://github.com/IgnisDa/ryot","vendor":"IgnisDa","versions":[{"lessThan":"10.5.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users."}],"id":"CVE-2026-127085","lastModified":"2026-11-13T15:53:39.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.010","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127086.json b/data/2026/CVE-2026-127086.json
index 62c9002704..01de350a4c 100644
--- a/data/2026/CVE-2026-127086.json
+++ b/data/2026/CVE-2026-127086.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/IgnisDa/ryot","product":"ryot","repo":"https://github.com/IgnisDa/ryot","vendor":"IgnisDa","versions":[{"lessThan":"10.5.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators."}],"id":"CVE-2026-127086","lastModified":"2026-11-13T10:18:05.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.163","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L137-L200"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-9v6w-g6x6-p4m5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-createorupdatecollection-updateid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/IgnisDa/ryot","product":"ryot","repo":"https://github.com/IgnisDa/ryot","vendor":"IgnisDa","versions":[{"lessThan":"10.5.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators."}],"id":"CVE-2026-127086","lastModified":"2026-11-13T15:53:39.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.163","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L137-L200"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-9v6w-g6x6-p4m5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-createorupdatecollection-updateid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127087.json b/data/2026/CVE-2026-127087.json
index 70c525b6cf..b9bf2a7c78 100644
--- a/data/2026/CVE-2026-127087.json
+++ b/data/2026/CVE-2026-127087.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/IgnisDa/ryot","product":"ryot","repo":"https://github.com/IgnisDa/ryot","vendor":"IgnisDa","versions":[{"lessThan":"10.5.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users."}],"id":"CVE-2026-127087","lastModified":"2026-11-13T10:18:05.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.310","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/database/src/lib.rs#L34-L45"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-9cwp-c4f6-rh6m"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-revokeaccesslink-graphql-mutation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/IgnisDa/ryot","product":"ryot","repo":"https://github.com/IgnisDa/ryot","vendor":"IgnisDa","versions":[{"lessThan":"10.5.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users."}],"id":"CVE-2026-127087","lastModified":"2026-11-13T15:53:39.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.310","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/database/src/lib.rs#L34-L45"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-9cwp-c4f6-rh6m"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-revokeaccesslink-graphql-mutation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127088.json b/data/2026/CVE-2026-127088.json
index 9741a2ba88..16fcd42419 100644
--- a/data/2026/CVE-2026-127088.json
+++ b/data/2026/CVE-2026-127088.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Bubka/2FAuth","product":"2FAuth","repo":"https://github.com/Bubka/2FAuth","vendor":"Bubka","versions":[{"lessThan":"9.0.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets."}],"id":"CVE-2026-127088","lastModified":"2026-11-13T10:18:05.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.457","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/releases/tag/v9.0.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Bubka/2FAuth","product":"2FAuth","repo":"https://github.com/Bubka/2FAuth","vendor":"Bubka","versions":[{"lessThan":"9.0.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets."}],"id":"CVE-2026-127088","lastModified":"2026-11-13T15:54:09.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.457","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/releases/tag/v9.0.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127090.json b/data/2026/CVE-2026-127090.json
index dcfd5461c6..4474a548ee 100644
--- a/data/2026/CVE-2026-127090.json
+++ b/data/2026/CVE-2026-127090.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:maven/com.sshtools/maverick-synergy-server","product":"Maverick Synergy Server","repo":"https://github.com/sshtools/maverick-synergy","vendor":"Jadaptive","versions":[{"lessThan":"3.0.33","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.1.7","status":"affected","version":"3.1.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Maverick Legacy Server","vendor":"Jadaptive","versions":[{"lessThan":"1.8.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account."}],"id":"CVE-2026-127090","lastModified":"2026-11-13T10:18:05.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.620","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100"},{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200"},{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"},{"source":"disclosure@vulncheck.com","url":"https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001"},{"source":"disclosure@vulncheck.com","url":"https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"},{"source":"disclosure@vulncheck.com","url":"https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-305"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:maven/com.sshtools/maverick-synergy-server","product":"Maverick Synergy Server","repo":"https://github.com/sshtools/maverick-synergy","vendor":"Jadaptive","versions":[{"lessThan":"3.0.33","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.1.7","status":"affected","version":"3.1.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Maverick Legacy Server","vendor":"Jadaptive","versions":[{"lessThan":"1.8.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account."}],"id":"CVE-2026-127090","lastModified":"2026-11-13T15:54:09.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.620","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100"},{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200"},{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"},{"source":"disclosure@vulncheck.com","url":"https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001"},{"source":"disclosure@vulncheck.com","url":"https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"},{"source":"disclosure@vulncheck.com","url":"https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-305"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127091.json b/data/2026/CVE-2026-127091.json
index 532b9a7448..1ae60e42e9 100644
--- a/data/2026/CVE-2026-127091.json
+++ b/data/2026/CVE-2026-127091.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:maven/com.sshtools/maverick-virtual-filesystem","product":"Maverick Synergy Server","repo":"https://github.com/sshtools/maverick-synergy","vendor":"Jadaptive","versions":[{"lessThan":"3.0.33","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.1.7","status":"affected","version":"3.1.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Maverick Legacy Server","vendor":"Jadaptive","versions":[{"lessThan":"1.8.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies."}],"id":"CVE-2026-127091","lastModified":"2026-11-13T10:18:05.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.797","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219"},{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb"},{"source":"disclosure@vulncheck.com","url":"https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002"},{"source":"disclosure@vulncheck.com","url":"https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"},{"source":"disclosure@vulncheck.com","url":"https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-41"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:maven/com.sshtools/maverick-virtual-filesystem","product":"Maverick Synergy Server","repo":"https://github.com/sshtools/maverick-synergy","vendor":"Jadaptive","versions":[{"lessThan":"3.0.33","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.1.7","status":"affected","version":"3.1.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Maverick Legacy Server","vendor":"Jadaptive","versions":[{"lessThan":"1.8.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies."}],"id":"CVE-2026-127091","lastModified":"2026-11-13T15:54:09.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.797","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219"},{"source":"disclosure@vulncheck.com","url":"https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb"},{"source":"disclosure@vulncheck.com","url":"https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002"},{"source":"disclosure@vulncheck.com","url":"https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"},{"source":"disclosure@vulncheck.com","url":"https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-41"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127093.json b/data/2026/CVE-2026-127093.json
index 7f134a0e7b..5e10b410c3 100644
--- a/data/2026/CVE-2026-127093.json
+++ b/data/2026/CVE-2026-127093.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/rustrak/rustrak","product":"rustrak","repo":"https://github.com/rustrak/rustrak","vendor":"rustrak","versions":[{"lessThan":"0.26.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response."}],"id":"CVE-2026-127093","lastModified":"2026-11-13T10:18:06.143","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:06.143","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/routes/alerts.rs#L422-L479"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/services/notification/webhook.rs#L161-L250"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/commit/f41c464ec56954b1876062d70aef920e786ca40b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/issues/504"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/pull/525"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/releases/tag/v0.26.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rustrak-before-0.26.0-ssrf-via-alert-integration-test-routing-override-url"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/rustrak/rustrak","product":"rustrak","repo":"https://github.com/rustrak/rustrak","vendor":"rustrak","versions":[{"lessThan":"0.26.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response."}],"id":"CVE-2026-127093","lastModified":"2026-11-13T16:18:54.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127093","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:31.376153Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:06.143","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/routes/alerts.rs#L422-L479"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/services/notification/webhook.rs#L161-L250"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/commit/f41c464ec56954b1876062d70aef920e786ca40b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/issues/504"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/pull/525"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustrak/rustrak/releases/tag/v0.26.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rustrak-before-0.26.0-ssrf-via-alert-integration-test-routing-override-url"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127094.json b/data/2026/CVE-2026-127094.json
index 40d197dc1e..01e9fcab8c 100644
--- a/data/2026/CVE-2026-127094.json
+++ b/data/2026/CVE-2026-127094.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"Pagelayer","repo":"https://plugins.svn.wordpress.org/pagelayer/","vendor":"Pagelayer Team","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.1.7","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers."}],"id":"CVE-2026-127094","lastModified":"2026-11-13T10:18:06.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:06.300","references":[{"source":"disclosure@vulncheck.com","url":"https://plugins.svn.wordpress.org/pagelayer/tags/2.1.9/main/abilitiesregister.php"},{"source":"disclosure@vulncheck.com","url":"https://plugins.trac.wordpress.org/changeset/3698421/pagelayer"},{"source":"disclosure@vulncheck.com","url":"https://wpsec.com/vuln/WPSEC-2026-0215"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pagelayer-2.1.7-before-2.2.1-missing-authorization-via-abilities-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"Pagelayer","repo":"https://plugins.svn.wordpress.org/pagelayer/","vendor":"Pagelayer Team","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.1.7","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers."}],"id":"CVE-2026-127094","lastModified":"2026-11-13T16:18:55.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:06.300","references":[{"source":"disclosure@vulncheck.com","url":"https://lazytitan.ro/pagelayer"},{"source":"disclosure@vulncheck.com","url":"https://plugins.svn.wordpress.org/pagelayer/tags/2.1.9/main/abilitiesregister.php"},{"source":"disclosure@vulncheck.com","url":"https://plugins.trac.wordpress.org/changeset/3698421/pagelayer"},{"source":"disclosure@vulncheck.com","url":"https://wpsec.com/vuln/WPSEC-2026-0215"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pagelayer-2.1.7-before-2.2.1-missing-authorization-via-abilities-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127102.json b/data/2026/CVE-2026-127102.json
new file mode 100644
index 0000000000..1e078f95bb
--- /dev/null
+++ b/data/2026/CVE-2026-127102.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse BaSyx Go Components","vendor":"Eclipse Foundation","versions":[{"lessThan":"1.1.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`.\n\n\n\nIf an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3."}],"id":"CVE-2026-127102","lastModified":"2026-11-13T15:17:44.177","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-13T15:17:44.177","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/basyx-go-components/commit/693e3c72b0dbdaf2c36a1112fde4c77b5d1ead3f"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.3"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/574"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1371"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-127119.json b/data/2026/CVE-2026-127119.json
index ddf036e7be..a06642bd7e 100644
--- a/data/2026/CVE-2026-127119.json
+++ b/data/2026/CVE-2026-127119.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-sdk-pandas","vendor":"AWS","versions":[{"lessThan":"3.18.0","status":"affected","version":"1.1.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket.\n\n\n\nTo remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use."}],"id":"CVE-2026-127119","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-12T19:17:03.430","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-181-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-sdk-pandas/releases/tag/3.18.0"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"},{"lang":"en","value":"CWE-341"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-sdk-pandas","vendor":"AWS","versions":[{"lessThan":"3.18.0","status":"affected","version":"1.1.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket.\n\n\n\nTo remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use."}],"id":"CVE-2026-127119","lastModified":"2026-11-13T15:17:44.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-12T19:17:03.430","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-181-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-sdk-pandas/releases/tag/3.18.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-sdk-pandas/security/advisories/GHSA-3rgm-255m-m9g5"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"},{"lang":"en","value":"CWE-341"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127915.json b/data/2026/CVE-2026-127915.json
index 46591424fa..e54b1067db 100644
--- a/data/2026/CVE-2026-127915.json
+++ b/data/2026/CVE-2026-127915.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/src/image_validate.c","boot/bootutil/src/tlv.c"],"programRoutines":[{"name":"bootutil_img_validate"},{"name":"bootutil_tlv_iter_next"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"0.9.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlv_off < it->tlv_end) and advances by sizeof(struct image_tlv) + tlv.it_len using the attacker-controlled it_len field, without validating that the entry's header or payload stays within it->tlv_end. As a result the 4-byte header read can extend up to 3 bytes past the declared TLV area, and the returned (off, len) can describe a payload that runs past it.\n\nThe path is pre-authentication: TLVs are parsed during bootutil_img_validate() before the signature is verified, and a crafted image can be presented through DFU / serial-recovery / OTA. However the impact is contained by surrounding guards: bootutil_img_validate() first rejects a TLV area larger than bootutil_max_image_size(), the default LOAD_IMAGE_DATA sink is flash_area_read() which bounds-checks against the flash partition and fails an out-of-partition read, and every payload consumer (EXPECTED_HASH_TLV, EXPECTED_KEY_TLV, EXPECTED_SIG_TLV, IMAGE_TLV_SEC_CNT) clamps len against a fixed buffer before copying.\n\nThe residual effect in a default flash build is therefore an out-of-region read confined to the attacker's own slot partition whose result is never observable, yielding at worst a clean validation failure rather than memory corruption or information disclosure. A genuine (though still bounded) out-of-bounds read remains under the non-default MCUBOOT_RAM_LOAD configuration, where LOAD_IMAGE_DATA is an unchecked memcpy. The fix is to validate each entry's header and payload against it->tlv_end inside the iterator."}],"id":"CVE-2026-127915","lastModified":"2026-11-13T02:18:55.863","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"LOW","baseScore":2.0,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":0.5,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:55.863","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/90f4e7c3ebe4cf9a5eb7d981220388ffdefd6d19"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-4fp3-3qw2-25jv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/src/image_validate.c","boot/bootutil/src/tlv.c"],"programRoutines":[{"name":"bootutil_img_validate"},{"name":"bootutil_tlv_iter_next"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"0.9.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlv_off < it->tlv_end) and advances by sizeof(struct image_tlv) + tlv.it_len using the attacker-controlled it_len field, without validating that the entry's header or payload stays within it->tlv_end. As a result the 4-byte header read can extend up to 3 bytes past the declared TLV area, and the returned (off, len) can describe a payload that runs past it.\n\nThe path is pre-authentication: TLVs are parsed during bootutil_img_validate() before the signature is verified, and a crafted image can be presented through DFU / serial-recovery / OTA. However the impact is contained by surrounding guards: bootutil_img_validate() first rejects a TLV area larger than bootutil_max_image_size(), the default LOAD_IMAGE_DATA sink is flash_area_read() which bounds-checks against the flash partition and fails an out-of-partition read, and every payload consumer (EXPECTED_HASH_TLV, EXPECTED_KEY_TLV, EXPECTED_SIG_TLV, IMAGE_TLV_SEC_CNT) clamps len against a fixed buffer before copying.\n\nThe residual effect in a default flash build is therefore an out-of-region read confined to the attacker's own slot partition whose result is never observable, yielding at worst a clean validation failure rather than memory corruption or information disclosure. A genuine (though still bounded) out-of-bounds read remains under the non-default MCUBOOT_RAM_LOAD configuration, where LOAD_IMAGE_DATA is an unchecked memcpy. The fix is to validate each entry's header and payload against it->tlv_end inside the iterator."}],"id":"CVE-2026-127915","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"LOW","baseScore":2.0,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":0.5,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:55.863","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/90f4e7c3ebe4cf9a5eb7d981220388ffdefd6d19"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-4fp3-3qw2-25jv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127916.json b/data/2026/CVE-2026-127916.json
index 35652510f8..61d327484f 100644
--- a/data/2026/CVE-2026-127916.json
+++ b/data/2026/CVE-2026-127916.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/src/bootutil_img_hash.c","boot/bootutil/src/image_validate.c"],"programRoutines":[{"name":"bootutil_img_hash"},{"name":"bootutil_img_validate"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"1.6.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutil_img_validate() compares the image size against bootutil_max_image_size() only after the hash has been computed.\n\nThe callers bound part of the span, or none of it:\n\nOn the swap and overwrite upgrade path, boot_validate_slot() first runs the image header check (boot_is_header_valid(), later boot_check_header_valid()). Before MCUboot 2.2.0 that check covered only ih_hdr_size + ih_img_size, so for every image the protected-TLV area (ih_protect_tlv_size, a uint16_t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ih_protect_tlv_size, except for a compressed image in the secondary slot when MCUBOOT_DECOMPRESS_IMAGES (CONFIG_BOOT_DECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB.\nThe serial recovery image-list and image-state handlers (bs_list() and bs_set() in boot/boot_serial/src/boot_serial.c) and Zephyr's single-slot and firmware loaders (boot/zephyr/single_loader.c, boot/zephyr/firmware_loader.c) call bootutil_img_validate() with no header check at all, so on those paths ih_img_size is unbounded as well.\n\nThe image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication.\n\nWhether a malformed header produces an actual read beyond the area depends on the flash backend:\n\nBackends whose flash_area_read() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read.\nWith MCUBOOT_HASH_STORAGE_DIRECTLY (Zephyr CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check.\nThe Cypress PSoC6 port's flash_area_read() (boot/cypress/cy_flash_pal/cy_flash_map.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy().\n\nThe bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path, and potentially much further on the paths that skip the header check. Where validation is repeated at every boot (a pending upgrade, or the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting.\n\nThe fix makes bootutil_img_hash() add the three sizes with boot_u32_safe_add() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller."}],"id":"CVE-2026-127916","lastModified":"2026-11-13T02:18:55.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:55.997","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/e9abe4f0292f0ed72391e146e098e22547b2d78b"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-c7cx-5pqv-x9m6"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/src/bootutil_img_hash.c","boot/bootutil/src/image_validate.c"],"programRoutines":[{"name":"bootutil_img_hash"},{"name":"bootutil_img_validate"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"1.6.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutil_img_validate() compares the image size against bootutil_max_image_size() only after the hash has been computed.\n\nThe callers bound part of the span, or none of it:\n\nOn the swap and overwrite upgrade path, boot_validate_slot() first runs the image header check (boot_is_header_valid(), later boot_check_header_valid()). Before MCUboot 2.2.0 that check covered only ih_hdr_size + ih_img_size, so for every image the protected-TLV area (ih_protect_tlv_size, a uint16_t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ih_protect_tlv_size, except for a compressed image in the secondary slot when MCUBOOT_DECOMPRESS_IMAGES (CONFIG_BOOT_DECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB.\nThe serial recovery image-list and image-state handlers (bs_list() and bs_set() in boot/boot_serial/src/boot_serial.c) and Zephyr's single-slot and firmware loaders (boot/zephyr/single_loader.c, boot/zephyr/firmware_loader.c) call bootutil_img_validate() with no header check at all, so on those paths ih_img_size is unbounded as well.\n\nThe image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication.\n\nWhether a malformed header produces an actual read beyond the area depends on the flash backend:\n\nBackends whose flash_area_read() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read.\nWith MCUBOOT_HASH_STORAGE_DIRECTLY (Zephyr CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check.\nThe Cypress PSoC6 port's flash_area_read() (boot/cypress/cy_flash_pal/cy_flash_map.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy().\n\nThe bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path, and potentially much further on the paths that skip the header check. Where validation is repeated at every boot (a pending upgrade, or the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting.\n\nThe fix makes bootutil_img_hash() add the three sizes with boot_u32_safe_add() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller."}],"id":"CVE-2026-127916","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:55.997","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/e9abe4f0292f0ed72391e146e098e22547b2d78b"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-c7cx-5pqv-x9m6"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127928.json b/data/2026/CVE-2026-127928.json
index badc5bd06d..0e84fa3193 100644
--- a/data/2026/CVE-2026-127928.json
+++ b/data/2026/CVE-2026-127928.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/boot_serial/src/boot_serial_encryption.c","boot/zephyr/single_loader.c"],"programRoutines":[{"name":"boot_image_validate_encrypted"},{"name":"decrypt_image_inplace"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"1.9.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In MCUboot's serial-recovery encrypted-image support (boot/boot_serial/src/boot_serial_encryption.c), decrypt_image_inplace() and boot_image_validate_encrypted() each keep a stack-local struct boot_status. boot_enc_load() writes the plaintext per-image AES key into its enckey[] field. Neither function cleared this structure before returning. In addition, a decrypt failure inside the per-sector loop of decrypt_image_inplace() returned early and skipped the total_out: cleanup, which left the expanded AES key context (enc_data) on the stack as well. The error paths of boot_image_validate_encrypted() similarly skipped boot_enc_zeroize().\n\nThe affected code is built when encrypted images (MCUBOOT_ENC_IMAGES, Zephyr CONFIG_BOOT_ENCRYPT_IMAGE) are combined with serial recovery. It runs when an encrypted image is uploaded to the primary slot over the recovery protocol, and when the image list or state is queried while an encrypted image is in the secondary slot. After these functions return, the image's AES content key remains in dead stack memory. An attacker who can later read device RAM, for example through a debug port or retained RAM, can recover it.\n\nThis weakens the confidentiality of image-encryption keys within the bootloader trust boundary. A recovered key exposes the plaintext of the encrypted firmware image it protects. The device's long-term private decryption key is not exposed. No remote or recovery-protocol channel that returns this memory is known, so exploitation requires a separate memory-read capability."}],"id":"CVE-2026-127928","lastModified":"2026-11-13T02:18:56.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":2.0,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:56.133","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/411949f830724617fbc08b9b32f0a45ba0c80baf"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-hqmg-jwp9-8cf8"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-226"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/boot_serial/src/boot_serial_encryption.c","boot/zephyr/single_loader.c"],"programRoutines":[{"name":"boot_image_validate_encrypted"},{"name":"decrypt_image_inplace"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"1.9.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In MCUboot's serial-recovery encrypted-image support (boot/boot_serial/src/boot_serial_encryption.c), decrypt_image_inplace() and boot_image_validate_encrypted() each keep a stack-local struct boot_status. boot_enc_load() writes the plaintext per-image AES key into its enckey[] field. Neither function cleared this structure before returning. In addition, a decrypt failure inside the per-sector loop of decrypt_image_inplace() returned early and skipped the total_out: cleanup, which left the expanded AES key context (enc_data) on the stack as well. The error paths of boot_image_validate_encrypted() similarly skipped boot_enc_zeroize().\n\nThe affected code is built when encrypted images (MCUBOOT_ENC_IMAGES, Zephyr CONFIG_BOOT_ENCRYPT_IMAGE) are combined with serial recovery. It runs when an encrypted image is uploaded to the primary slot over the recovery protocol, and when the image list or state is queried while an encrypted image is in the secondary slot. After these functions return, the image's AES content key remains in dead stack memory. An attacker who can later read device RAM, for example through a debug port or retained RAM, can recover it.\n\nThis weakens the confidentiality of image-encryption keys within the bootloader trust boundary. A recovered key exposes the plaintext of the encrypted firmware image it protects. The device's long-term private decryption key is not exposed. No remote or recovery-protocol channel that returns this memory is known, so exploitation requires a separate memory-read capability."}],"id":"CVE-2026-127928","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":2.0,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:56.133","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/411949f830724617fbc08b9b32f0a45ba0c80baf"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-hqmg-jwp9-8cf8"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-226"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128016.json b/data/2026/CVE-2026-128016.json
index 65a65f4bb3..b820b9e359 100644
--- a/data/2026/CVE-2026-128016.json
+++ b/data/2026/CVE-2026-128016.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","product":"frankenphp","vendor":"php","versions":[{"lessThan":"1.13.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.13.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process."}],"id":"CVE-2026-128016","lastModified":"2026-11-13T10:18:06.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:06.807","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/php/frankenphp/security/advisories/GHSA-cm3q-jw2q-9rh5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-of-spltempfileobject-streams-in-worker-mode"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","product":"frankenphp","vendor":"php","versions":[{"lessThan":"1.13.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.13.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process."}],"id":"CVE-2026-128016","lastModified":"2026-11-13T16:18:55.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128016","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:29.060551Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:06.807","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/php/frankenphp/security/advisories/GHSA-cm3q-jw2q-9rh5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-of-spltempfileobject-streams-in-worker-mode"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128020.json b/data/2026/CVE-2026-128020.json
index 727dd1430b..e74557c546 100644
--- a/data/2026/CVE-2026-128020.json
+++ b/data/2026/CVE-2026-128020.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","product":"frankenphp","vendor":"php","versions":[{"lessThan":"1.13.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.13.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process."}],"id":"CVE-2026-128020","lastModified":"2026-11-13T10:18:07.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:07.467","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/php/frankenphp/security/advisories/GHSA-ccgp-ch9h-533f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-cyclic-array-conversion"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","product":"frankenphp","vendor":"php","versions":[{"lessThan":"1.13.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.13.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process."}],"id":"CVE-2026-128020","lastModified":"2026-11-13T16:18:56.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128020","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:26.503479Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:07.467","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/php/frankenphp/security/advisories/GHSA-ccgp-ch9h-533f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-cyclic-array-conversion"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128024.json b/data/2026/CVE-2026-128024.json
index ddaa500711..6c127fb8df 100644
--- a/data/2026/CVE-2026-128024.json
+++ b/data/2026/CVE-2026-128024.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","product":"frankenphp","vendor":"php","versions":[{"lessThan":"1.13.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.13.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request."}],"id":"CVE-2026-128024","lastModified":"2026-11-13T10:18:08.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:08.083","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/php/frankenphp/security/advisories/GHSA-4prg-hv4r-g6mv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.0-denial-of-service-via-goarray-nil-type-assertion"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","product":"frankenphp","vendor":"php","versions":[{"lessThan":"1.13.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.13.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request."}],"id":"CVE-2026-128024","lastModified":"2026-11-13T16:18:57.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128024","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:23.846351Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:08.083","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/php/frankenphp/security/advisories/GHSA-4prg-hv4r-g6mv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.0-denial-of-service-via-goarray-nil-type-assertion"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128028.json b/data/2026/CVE-2026-128028.json
index a5186d5740..fa1613a0cb 100644
--- a/data/2026/CVE-2026-128028.json
+++ b/data/2026/CVE-2026-128028.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin."}],"id":"CVE-2026-128028","lastModified":"2026-11-13T10:18:08.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:08.703","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5896b2a60b10e892cec594391b2612ab53a4ce59"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-v7mx-rv47-452m"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-custom-option-svg-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin."}],"id":"CVE-2026-128028","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:08.703","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5896b2a60b10e892cec594391b2612ab53a4ce59"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-v7mx-rv47-452m"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-custom-option-svg-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128029.json b/data/2026/CVE-2026-128029.json
index f9851c91b8..b6d606e1f3 100644
--- a/data/2026/CVE-2026-128029.json
+++ b/data/2026/CVE-2026-128029.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it."}],"id":"CVE-2026-128029","lastModified":"2026-11-13T10:18:08.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:08.850","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-28hq-mq6h-fh2x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-dataflow-import-row-errors"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it."}],"id":"CVE-2026-128029","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:08.850","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-28hq-mq6h-fh2x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-dataflow-import-row-errors"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128030.json b/data/2026/CVE-2026-128030.json
index 7e33d24b8b..92d80c39d4 100644
--- a/data/2026/CVE-2026-128030.json
+++ b/data/2026/CVE-2026-128030.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data."}],"id":"CVE-2026-128030","lastModified":"2026-11-13T10:18:08.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:08.990","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/73048b7d8380fefb423869342c708ac30f80bc4b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/9daf2c647759816ade7be2c906f08f56cb43a864"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rrhg-c635-fmrm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-insufficient-session-expiration-after-api-user-deactivation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data."}],"id":"CVE-2026-128030","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:08.990","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/73048b7d8380fefb423869342c708ac30f80bc4b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/9daf2c647759816ade7be2c906f08f56cb43a864"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rrhg-c635-fmrm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-insufficient-session-expiration-after-api-user-deactivation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128031.json b/data/2026/CVE-2026-128031.json
index 2cabb5fbba..48477127b8 100644
--- a/data/2026/CVE-2026-128031.json
+++ b/data/2026/CVE-2026-128031.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions."}],"id":"CVE-2026-128031","lastModified":"2026-11-13T10:18:09.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.133","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/37fa46699ea0d3c4301994dc9411b5639b2ffc2f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/b36d00df844ad127b24b481e1d4c2df90b75d559"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-wgf8-gh63-gfqf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-incorrect-authorization-in-admin-controllers-acl"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions."}],"id":"CVE-2026-128031","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.133","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/37fa46699ea0d3c4301994dc9411b5639b2ffc2f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/b36d00df844ad127b24b481e1d4c2df90b75d559"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-wgf8-gh63-gfqf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-incorrect-authorization-in-admin-controllers-acl"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128032.json b/data/2026/CVE-2026-128032.json
index 79f9870c7d..5306218a62 100644
--- a/data/2026/CVE-2026-128032.json
+++ b/data/2026/CVE-2026-128032.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order."}],"id":"CVE-2026-128032","lastModified":"2026-11-13T10:18:09.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/ae520e9197c4bf86d6e3b39fdded23958bf9d2d1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rmw8-7h79-p386"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-payment-bypass-via-free-payment-method"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-841"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order."}],"id":"CVE-2026-128032","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/ae520e9197c4bf86d6e3b39fdded23958bf9d2d1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rmw8-7h79-p386"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-payment-bypass-via-free-payment-method"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-841"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128033.json b/data/2026/CVE-2026-128033.json
index 9082873e4a..82c30c6f95 100644
--- a/data/2026/CVE-2026-128033.json
+++ b/data/2026/CVE-2026-128033.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes."}],"id":"CVE-2026-128033","lastModified":"2026-11-13T10:18:09.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.410","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2b7795664d55aadc43cc74e1527ab5b046ff7a8a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-wmwx-442r-jc88"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-information-disclosure-via-order-status-rss-feed"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes."}],"id":"CVE-2026-128033","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.410","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2b7795664d55aadc43cc74e1527ab5b046ff7a8a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-wmwx-442r-jc88"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-information-disclosure-via-order-status-rss-feed"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128034.json b/data/2026/CVE-2026-128034.json
new file mode 100644
index 0000000000..b0388a6b02
--- /dev/null
+++ b/data/2026/CVE-2026-128034.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"github.com/gittuf/gittuf","product":"gittuf","repo":"https://github.com/gittuf/gittuf","vendor":"gittuf","versions":[{"lessThan":"0.18.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification."}],"id":"CVE-2026-128034","lastModified":"2026-11-13T16:18:58.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]},"published":"2026-11-13T16:18:58.683","references":[{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/gittuf/gittuf/releases/tag/v0.18.0"},{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/gittuf/gittuf/security/advisories/GHSA-hxqr-h35w-2898"}],"sourceIdentifier":"7fefd608-56a6-419f-a002-fd8543c0710a","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128035.json b/data/2026/CVE-2026-128035.json
new file mode 100644
index 0000000000..3e54050be8
--- /dev/null
+++ b/data/2026/CVE-2026-128035.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"github.com/gittuf/gittuf","product":"gittuf","repo":"https://github.com/gittuf/gittuf","vendor":"gittuf","versions":[{"lessThan":"0.18.0","status":"affected","version":"0.10.0","versionType":"semver"}]}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification."}],"id":"CVE-2026-128035","lastModified":"2026-11-13T16:18:58.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]},"published":"2026-11-13T16:18:58.833","references":[{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/gittuf/gittuf/releases/tag/v0.18.0"},{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/gittuf/gittuf/security/advisories/GHSA-pchw-g6rm-gxvh"}],"sourceIdentifier":"7fefd608-56a6-419f-a002-fd8543c0710a","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128036.json b/data/2026/CVE-2026-128036.json
new file mode 100644
index 0000000000..9b2d8e1887
--- /dev/null
+++ b/data/2026/CVE-2026-128036.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"github.com/gittuf/gittuf","product":"gittuf","repo":"https://github.com/gittuf/gittuf","vendor":"gittuf","versions":[{"lessThan":"0.17.0","status":"affected","version":"0.4.0","versionType":"semver"}]}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In gittuf 0.4.0 through 0.16.0, when a policy update appears within the range of reference state log entries being verified, verification checks only the root of trust signatures of the new policy and not the signatures of its other metadata (rule files). A user trusted to push to the repository who bypasses gittuf policy apply and writes the policy reference and reference state log directly can make an invalid policy apply during verification, weakening or strengthening the rules for later changes. The update is still recorded in the reference state log."}],"id":"CVE-2026-128036","lastModified":"2026-11-13T16:18:59.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]},"published":"2026-11-13T16:18:58.970","references":[{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/gittuf/gittuf/releases/tag/v0.17.0"},{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/gittuf/gittuf/security/advisories/GHSA-774m-m728-236h"}],"sourceIdentifier":"7fefd608-56a6-419f-a002-fd8543c0710a","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128037.json b/data/2026/CVE-2026-128037.json
new file mode 100644
index 0000000000..a1a54d88b0
--- /dev/null
+++ b/data/2026/CVE-2026-128037.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"github.com/gittuf/gittuf","product":"gittuf","repo":"https://github.com/gittuf/gittuf","vendor":"gittuf","versions":[{"lessThan":"0.16.0","status":"affected","version":"0.10.0","versionType":"semver"}]}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, verification gives the global rule's check over all trusted users in the policy precedence over the policy rule's own authorized users. A user listed in the policy file but not authorized by the policy rule, or fewer users than the rule's threshold, can make changes to the protected namespace that pass verification."}],"id":"CVE-2026-128037","lastModified":"2026-11-13T16:18:59.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]},"published":"2026-11-13T16:18:59.117","references":[{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/gittuf/gittuf/releases/tag/v0.16.0"},{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/gittuf/gittuf/security/advisories/GHSA-qc8j-pcph-6q9x"}],"sourceIdentifier":"7fefd608-56a6-419f-a002-fd8543c0710a","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128040.json b/data/2026/CVE-2026-128040.json
index 84f9114346..4fcafc0a16 100644
--- a/data/2026/CVE-2026-128040.json
+++ b/data/2026/CVE-2026-128040.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges."}],"id":"CVE-2026-128040","lastModified":"2026-11-13T10:18:09.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.547","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/62d2885fa6e7a4454e3a5c7765a6a5ca0085ecc1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/7f7a9deaac11fd2437bb1f8065db152a4b620609"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/e97e257b8f8d74d2e52dbf28caa211c262ff26be"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m858-x59w-rmp5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-admin-dataflow-tax-oauth-paypal-fields"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges."}],"id":"CVE-2026-128040","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.547","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/62d2885fa6e7a4454e3a5c7765a6a5ca0085ecc1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/7f7a9deaac11fd2437bb1f8065db152a4b620609"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/e97e257b8f8d74d2e52dbf28caa211c262ff26be"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m858-x59w-rmp5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-admin-dataflow-tax-oauth-paypal-fields"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128041.json b/data/2026/CVE-2026-128041.json
index 6a7ebf25d9..a8f44dfc50 100644
--- a/data/2026/CVE-2026-128041.json
+++ b/data/2026/CVE-2026-128041.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover."}],"id":"CVE-2026-128041","lastModified":"2026-11-13T10:18:09.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.700","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/34e88f5447dff22e4ddc8cb0952d934ac3fdd15b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-j9c5-pcvx-jx9x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-rss-review-feed"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover."}],"id":"CVE-2026-128041","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.700","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/34e88f5447dff22e4ddc8cb0952d934ac3fdd15b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-j9c5-pcvx-jx9x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-rss-review-feed"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128042.json b/data/2026/CVE-2026-128042.json
index bdb5faa3a5..1483f4594e 100644
--- a/data/2026/CVE-2026-128042.json
+++ b/data/2026/CVE-2026-128042.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.19.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows."}],"id":"CVE-2026-128042","lastModified":"2026-11-13T10:18:09.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.843","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2626f027a752cda004c5cf7f8f9bd3cf52f525f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5rg7-22cv-c9q6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-race-condition-in-coupon-usage-limits"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.19.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows."}],"id":"CVE-2026-128042","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.843","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2626f027a752cda004c5cf7f8f9bd3cf52f525f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5rg7-22cv-c9q6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-race-condition-in-coupon-usage-limits"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128043.json b/data/2026/CVE-2026-128043.json
index 22ae6b0e0e..6462a1717c 100644
--- a/data/2026/CVE-2026-128043.json
+++ b/data/2026/CVE-2026-128043.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.19.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart."}],"id":"CVE-2026-128043","lastModified":"2026-11-13T10:18:09.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.983","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/86c8895d586db61ac7d093ba4e473103a30882c8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-2jfg-wx75-5cc8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-csrf-via-paypal-cancel-return-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.19.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart."}],"id":"CVE-2026-128043","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.983","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/86c8895d586db61ac7d093ba4e473103a30882c8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-2jfg-wx75-5cc8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-csrf-via-paypal-cancel-return-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128044.json b/data/2026/CVE-2026-128044.json
index 0a4426269a..2da1e7de2c 100644
--- a/data/2026/CVE-2026-128044.json
+++ b/data/2026/CVE-2026-128044.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges."}],"id":"CVE-2026-128044","lastModified":"2026-11-13T10:18:10.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.123","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/d03a00b60e4a2d4e5a00b44dbc66d25bc3b3fc8f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-mffc-h5pf-6f42"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-oauth-callback-url-allowlist-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges."}],"id":"CVE-2026-128044","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.123","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/d03a00b60e4a2d4e5a00b44dbc66d25bc3b3fc8f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-mffc-h5pf-6f42"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-oauth-callback-url-allowlist-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128045.json b/data/2026/CVE-2026-128045.json
index ddf56a732c..46aed5ef07 100644
--- a/data/2026/CVE-2026-128045.json
+++ b/data/2026/CVE-2026-128045.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled."}],"id":"CVE-2026-128045","lastModified":"2026-11-13T10:18:10.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.260","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3hh8-xg45-mwrr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-authorization-bypass-via-forgeable-rss-order-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled."}],"id":"CVE-2026-128045","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.260","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3hh8-xg45-mwrr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-authorization-bypass-via-forgeable-rss-order-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128046.json b/data/2026/CVE-2026-128046.json
index a4c536dc58..fbec7721c0 100644
--- a/data/2026/CVE-2026-128046.json
+++ b/data/2026/CVE-2026-128046.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"20.17.0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory."}],"id":"CVE-2026-128046","lastModified":"2026-11-13T10:18:10.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.400","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/ba76b2346fe1e380f39c23e68ccb818d7324d24f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-4fxg-469f-r6fc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-20.17.0-before-20.18.2-unrestricted-file-upload-rce-via-custom-options"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"20.17.0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory."}],"id":"CVE-2026-128046","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.400","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/ba76b2346fe1e380f39c23e68ccb818d7324d24f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-4fxg-469f-r6fc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-20.17.0-before-20.18.2-unrestricted-file-upload-rce-via-custom-options"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128047.json b/data/2026/CVE-2026-128047.json
index 9eb6ca079a..b26949404e 100644
--- a/data/2026/CVE-2026-128047.json
+++ b/data/2026/CVE-2026-128047.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state."}],"id":"CVE-2026-128047","lastModified":"2026-11-13T10:18:10.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.543","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/4a8d91c692524de4a07e70af5367b6cb67a9516d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/9f5a1c3cf63f5cf6ac9f90b041a97a474cea04c2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-7j66-6mw7-rgfx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-account-takeover-via-predictable-confirmation-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state."}],"id":"CVE-2026-128047","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.543","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/4a8d91c692524de4a07e70af5367b6cb67a9516d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/9f5a1c3cf63f5cf6ac9f90b041a97a474cea04c2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-7j66-6mw7-rgfx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-account-takeover-via-predictable-confirmation-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128048.json b/data/2026/CVE-2026-128048.json
index 5851c147f4..0af04001a8 100644
--- a/data/2026/CVE-2026-128048.json
+++ b/data/2026/CVE-2026-128048.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials."}],"id":"CVE-2026-128048","lastModified":"2026-11-13T10:18:10.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.680","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/6763d33dfdb7fb33704ad095eb8e4d5a20e30f75"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-94p5-6j66-c9j6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-information-disclosure-via-email-template-getconfig"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-178"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials."}],"id":"CVE-2026-128048","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.680","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/6763d33dfdb7fb33704ad095eb8e4d5a20e30f75"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-94p5-6j66-c9j6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-information-disclosure-via-email-template-getconfig"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-178"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128049.json b/data/2026/CVE-2026-128049.json
index 36162664e3..dad9e95a2d 100644
--- a/data/2026/CVE-2026-128049.json
+++ b/data/2026/CVE-2026-128049.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim."}],"id":"CVE-2026-128049","lastModified":"2026-11-13T10:18:10.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.820","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/1f83e49b60e08aa7ba89dcc2d41ea21f62c0b796"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-grrq-9gq2-vm55"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-csrf-via-oauth-authorization-confirm"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim."}],"id":"CVE-2026-128049","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.820","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/1f83e49b60e08aa7ba89dcc2d41ea21f62c0b796"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-grrq-9gq2-vm55"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-csrf-via-oauth-authorization-confirm"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128051.json b/data/2026/CVE-2026-128051.json
index 8ceb820412..1e2be34b09 100644
--- a/data/2026/CVE-2026-128051.json
+++ b/data/2026/CVE-2026-128051.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages."}],"id":"CVE-2026-128051","lastModified":"2026-11-13T10:18:10.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.957","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2437b01af99279aa1c6ca5c19f919449b38a5a66"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/64ff7fce3db72cad83e41131bdf48c42ba2ad2f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hfqq-c3qm-38x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-name-in-msrp-popup"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages."}],"id":"CVE-2026-128051","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.957","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2437b01af99279aa1c6ca5c19f919449b38a5a66"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/64ff7fce3db72cad83e41131bdf48c42ba2ad2f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hfqq-c3qm-38x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-name-in-msrp-popup"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128052.json b/data/2026/CVE-2026-128052.json
index e6461a9a66..6e86659963 100644
--- a/data/2026/CVE-2026-128052.json
+++ b/data/2026/CVE-2026-128052.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.19.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information."}],"id":"CVE-2026-128052","lastModified":"2026-11-13T10:18:11.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.100","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/055ccb866c0fadfed2c27e8c0e9ebd10db0199df"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fqq6-76qg-2r96"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-block-whitelist-bypass-via-layout-directive"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.19.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information."}],"id":"CVE-2026-128052","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.100","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/055ccb866c0fadfed2c27e8c0e9ebd10db0199df"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fqq6-76qg-2r96"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-block-whitelist-bypass-via-layout-directive"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128053.json b/data/2026/CVE-2026-128053.json
index 9c1bf28184..a1ea09fe20 100644
--- a/data/2026/CVE-2026-128053.json
+++ b/data/2026/CVE-2026-128053.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers."}],"id":"CVE-2026-128053","lastModified":"2026-11-13T10:18:11.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.240","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/0bcec215c25941f900d46657d63fd0862960edf6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6pvw-8mv9-r8vr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-reflected-xss-via-error-pages-script-name"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers."}],"id":"CVE-2026-128053","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.240","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/0bcec215c25941f900d46657d63fd0862960edf6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6pvw-8mv9-r8vr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-reflected-xss-via-error-pages-script-name"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128091.json b/data/2026/CVE-2026-128091.json
index b3de382dba..e2e3f695a4 100644
--- a/data/2026/CVE-2026-128091.json
+++ b/data/2026/CVE-2026-128091.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/include/bootutil/crypto/aes_ctr.h","boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h","boot/bootutil/src/encrypted.c"],"programRoutines":[{"name":"boot_decrypt_key"},{"name":"boot_enc_drop"},{"name":"boot_state_clear"},{"name":"bootutil_aes_ctr_drop"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"1.3.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h was an empty stub. The AES-CTR context for this backend is the fully expanded AES-128 key schedule (struct tc_aes_key_sched_struct). Generic code relies on this hook to release and clear key state, so with TinyCrypt nothing was cleared. The mbedTLS and PSA backends do free or destroy their key state here.\n\nAs a result, boot_state_clear(), which boot_go() calls before handing off to the application, left the image's AES content-encryption key schedule in the static boot_data state. This is the case after an encrypted upgrade in single-image builds, where boot_enc_zeroize() is not called. boot_decrypt_key() likewise left the ECIES-derived key-encryption key schedule on the stack. The affected build uses MCUBOOT_ENC_IMAGES with TinyCrypt, which is the default ECDSA and Ed25519 backend in the Zephyr port.\n\nThe first AES-128 round key equals the cipher key, so anyone who can read the leftover bootloader RAM after boot can recover the image content key and decrypt that encrypted image. That includes a physical attacker with debug or RAM access, or code later running on the device. This weakens image-encryption key confidentiality (and so the confidentiality of the encrypted image's plaintext). The device's long-term private decryption key is not exposed, and image authenticity is not affected. The fix wipes the context with bootutil_wipe_memory()."}],"id":"CVE-2026-128091","lastModified":"2026-11-13T02:18:56.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":2.0,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:56.370","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/d204aaa3ab40c0b37a52d3b4c433b437f9ad8374"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-wx3x-935q-6rcf"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-226"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/include/bootutil/crypto/aes_ctr.h","boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h","boot/bootutil/src/encrypted.c"],"programRoutines":[{"name":"boot_decrypt_key"},{"name":"boot_enc_drop"},{"name":"boot_state_clear"},{"name":"bootutil_aes_ctr_drop"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"1.3.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h was an empty stub. The AES-CTR context for this backend is the fully expanded AES-128 key schedule (struct tc_aes_key_sched_struct). Generic code relies on this hook to release and clear key state, so with TinyCrypt nothing was cleared. The mbedTLS and PSA backends do free or destroy their key state here.\n\nAs a result, boot_state_clear(), which boot_go() calls before handing off to the application, left the image's AES content-encryption key schedule in the static boot_data state. This is the case after an encrypted upgrade in single-image builds, where boot_enc_zeroize() is not called. boot_decrypt_key() likewise left the ECIES-derived key-encryption key schedule on the stack. The affected build uses MCUBOOT_ENC_IMAGES with TinyCrypt, which is the default ECDSA and Ed25519 backend in the Zephyr port.\n\nThe first AES-128 round key equals the cipher key, so anyone who can read the leftover bootloader RAM after boot can recover the image content key and decrypt that encrypted image. That includes a physical attacker with debug or RAM access, or code later running on the device. This weakens image-encryption key confidentiality (and so the confidentiality of the encrypted image's plaintext). The device's long-term private decryption key is not exposed, and image authenticity is not affected. The fix wipes the context with bootutil_wipe_memory()."}],"id":"CVE-2026-128091","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":2.0,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:56.370","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/d204aaa3ab40c0b37a52d3b4c433b437f9ad8374"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-wx3x-935q-6rcf"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-226"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128237.json b/data/2026/CVE-2026-128237.json
index 7be3570bc5..2f43704740 100644
--- a/data/2026/CVE-2026-128237.json
+++ b/data/2026/CVE-2026-128237.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/Scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.8.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+."}],"id":"CVE-2026-128237","lastModified":"2026-11-13T10:18:11.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.380","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-xx44-g48m-mjp6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.8.0-denial-of-service-via-quadratic-ber-oid-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/Scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.8.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+."}],"id":"CVE-2026-128237","lastModified":"2026-11-13T15:54:09.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.380","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-xx44-g48m-mjp6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.8.0-denial-of-service-via-quadratic-ber-oid-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128238.json b/data/2026/CVE-2026-128238.json
index 610cf84e2e..642eef6637 100644
--- a/data/2026/CVE-2026-128238.json
+++ b/data/2026/CVE-2026-128238.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.8.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True."}],"id":"CVE-2026-128238","lastModified":"2026-11-13T10:18:11.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.520","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-456h-w4v7-hvpr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.8.0-uncontrolled-recursion-dos-via-ber-sequence-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.8.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True."}],"id":"CVE-2026-128238","lastModified":"2026-11-13T15:54:09.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.520","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-456h-w4v7-hvpr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.8.0-uncontrolled-recursion-dos-via-ber-sequence-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128336.json b/data/2026/CVE-2026-128336.json
index 26d92e73e6..584fc49772 100644
--- a/data/2026/CVE-2026-128336.json
+++ b/data/2026/CVE-2026-128336.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets __proto__, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs."}],"id":"CVE-2026-128336","lastModified":"2026-11-13T10:18:13.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:13.757","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L50-L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pwgq-2cgg-6ph9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-proto-defined-name"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets __proto__, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs."}],"id":"CVE-2026-128336","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:13.757","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L50-L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pwgq-2cgg-6ph9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-proto-defined-name"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128337.json b/data/2026/CVE-2026-128337.json
index 32fe329b77..4b87d8a821 100644
--- a/data/2026/CVE-2026-128337.json
+++ b/data/2026/CVE-2026-128337.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of __proto__. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts."}],"id":"CVE-2026-128337","lastModified":"2026-11-13T10:18:13.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:13.920","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/worksheet-xform.js#L34-L42"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/worksheet-xform.js#L55-L74"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-86ch-m4gp-r5xf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-x14-conditional-formatting-rule-id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of __proto__. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts."}],"id":"CVE-2026-128337","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:13.920","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/worksheet-xform.js#L34-L42"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/worksheet-xform.js#L55-L74"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-86ch-m4gp-r5xf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-x14-conditional-formatting-rule-id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128338.json b/data/2026/CVE-2026-128338.json
index e8baa75308..765d23d1fa 100644
--- a/data/2026/CVE-2026-128338.json
+++ b/data/2026/CVE-2026-128338.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error."}],"id":"CVE-2026-128338","lastModified":"2026-11-13T10:18:14.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.073","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/column.js#L307-L316"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/col-xform.js#L43-L47"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-w57r-3mm6-w6g7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-unbounded-worksheet-column-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error."}],"id":"CVE-2026-128338","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.073","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/column.js#L307-L316"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/col-xform.js#L43-L47"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-w57r-3mm6-w6g7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-unbounded-worksheet-column-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128339.json b/data/2026/CVE-2026-128339.json
index 6731186fe5..e0295e0ce3 100644
--- a/data/2026/CVE-2026-128339.json
+++ b/data/2026/CVE-2026-128339.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process."}],"id":"CVE-2026-128339","lastModified":"2026-11-13T10:18:14.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.223","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L613-L632"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L895-L901"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/issues/3107"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/pull/3114"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-wh3v-83h4-rwwq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-merged-cell-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process."}],"id":"CVE-2026-128339","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.223","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L613-L632"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L895-L901"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/issues/3107"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/pull/3114"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-wh3v-83h4-rwwq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-merged-cell-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128340.json b/data/2026/CVE-2026-128340.json
index 2cfb0fd4a8..87c4c58803 100644
--- a/data/2026/CVE-2026-128340.json
+++ b/data/2026/CVE-2026-128340.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load()."}],"id":"CVE-2026-128340","lastModified":"2026-11-13T10:18:14.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.373","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L28-L37"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qvh4-wwpm-ggc8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-defined-name-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load()."}],"id":"CVE-2026-128340","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.373","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L28-L37"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qvh4-wwpm-ggc8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-defined-name-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128341.json b/data/2026/CVE-2026-128341.json
index 0fbbcfa350..b3a8a14d8e 100644
--- a/data/2026/CVE-2026-128341.json
+++ b/data/2026/CVE-2026-128341.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error."}],"id":"CVE-2026-128341","lastModified":"2026-11-13T10:18:14.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.530","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/data-validations-xform.js#L216-L227"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/issues/3093"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f689-fh93-2pm2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-data-validation-sqref"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error."}],"id":"CVE-2026-128341","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.530","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/data-validations-xform.js#L216-L227"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/issues/3093"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f689-fh93-2pm2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-data-validation-sqref"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128342.json b/data/2026/CVE-2026-128342.json
index dd687cb3cb..1cc296e6dc 100644
--- a/data/2026/CVE-2026-128342.json
+++ b/data/2026/CVE-2026-128342.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and writeBuffer for seconds."}],"id":"CVE-2026-128342","lastModified":"2026-11-13T10:18:14.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L119-L125"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L200-L206"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9vv6-5g3h-prg5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-worksheet-sheetid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-606"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and writeBuffer for seconds."}],"id":"CVE-2026-128342","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L119-L125"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L200-L206"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9vv6-5g3h-prg5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-worksheet-sheetid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-606"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128343.json b/data/2026/CVE-2026-128343.json
index c5cceed1fa..be91f5493f 100644
--- a/data/2026/CVE-2026-128343.json
+++ b/data/2026/CVE-2026-128343.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number."}],"id":"CVE-2026-128343","lastModified":"2026-11-13T10:18:14.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.823","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-606"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number."}],"id":"CVE-2026-128343","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.823","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-606"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128344.json b/data/2026/CVE-2026-128344.json
index 4dc5f4caca..c191a25868 100644
--- a/data/2026/CVE-2026-128344.json
+++ b/data/2026/CVE-2026-128344.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error."}],"id":"CVE-2026-128344","lastModified":"2026-11-13T10:18:14.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.977","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/anchor.js#L40-L64"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L243-L261"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-cqmf-h7c5-g7xx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-image-anchor-column"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error."}],"id":"CVE-2026-128344","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.977","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/anchor.js#L40-L64"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L243-L261"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-cqmf-h7c5-g7xx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-image-anchor-column"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128345.json b/data/2026/CVE-2026-128345.json
index f842b2bcc4..ede47350a8 100644
--- a/data/2026/CVE-2026-128345.json
+++ b/data/2026/CVE-2026-128345.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic regex backtracking that blocks the Node.js event loop."}],"id":"CVE-2026-128345","lastModified":"2026-11-13T10:18:15.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.127","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/shared-formula.js#L4-L12"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pr65-54q8-vhqm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-redos-via-slideformula-shared-formula-translation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic regex backtracking that blocks the Node.js event loop."}],"id":"CVE-2026-128345","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.127","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/shared-formula.js#L4-L12"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pr65-54q8-vhqm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-redos-via-slideformula-shared-formula-translation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128346.json b/data/2026/CVE-2026-128346.json
index 4a8ffe845d..d531b27a2a 100644
--- a/data/2026/CVE-2026-128346.json
+++ b/data/2026/CVE-2026-128346.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors."}],"id":"CVE-2026-128346","lastModified":"2026-11-13T10:18:15.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-reader.js#L111-L128"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-reader.js#L140-L149"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-mp7v-gxhv-42h2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-resource-exhaustion-via-streaming-workbookreader-temporary-files"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors."}],"id":"CVE-2026-128346","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-reader.js#L111-L128"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-reader.js#L140-L149"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-mp7v-gxhv-42h2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-resource-exhaustion-via-streaming-workbookreader-temporary-files"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128347.json b/data/2026/CVE-2026-128347.json
index 6cd9975a80..bc23592a94 100644
--- a/data/2026/CVE-2026-128347.json
+++ b/data/2026/CVE-2026-128347.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook."}],"id":"CVE-2026-128347","lastModified":"2026-11-13T10:18:15.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook."}],"id":"CVE-2026-128347","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128348.json b/data/2026/CVE-2026-128348.json
index 1334c7ab1e..90fa256fc5 100644
--- a/data/2026/CVE-2026-128348.json
+++ b/data/2026/CVE-2026-128348.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook."}],"id":"CVE-2026-128348","lastModified":"2026-11-13T10:18:15.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook."}],"id":"CVE-2026-128348","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128907.json b/data/2026/CVE-2026-128907.json
new file mode 100644
index 0000000000..25acd27f2c
--- /dev/null
+++ b/data/2026/CVE-2026-128907.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","modules":["1300 DM810X communications board (uavmonitor_usbv1)"],"platforms":["ARM"],"product":"AeroScope Mobile (TP703)","programFiles":["opt/dvr_rdk/ti810x/bin/uavmonitor_usbv1"],"vendor":"DJI","versions":[{"status":"affected","version":"03.00.00.26","versionType":"custom"}]},{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","platforms":["ARM"],"product":"AeroScope Mobile (TP703) 1300 communications board firmware","programFiles":["opt/dvr_rdk/ti810x/bin/uavmonitor_usbv1"],"vendor":"DJI","versions":[{"lessThanOrEqual":"02.00.08.40","status":"affected","version":"02.00.07.12","versionType":"custom"}]}],"source":"vulnerability@ncsc.ch"}],"cveTags":[{"sourceIdentifier":"vulnerability@ncsc.ch","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Missing authentication for a critical function (CWE-306) in the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to read device information, such as the serial number, MAC address, IP address and radio configuration, and to change configuration settings. The service accepts commands in DJI's proprietary DUML protocol without any authentication. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The same commands are also accepted over the USB operator port. Confirmed on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available."}],"id":"CVE-2026-128907","lastModified":"2026-11-13T15:17:44.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"vulnerability@ncsc.ch","type":"Secondary"}]},"published":"2026-11-13T15:17:44.447","references":[{"source":"vulnerability@ncsc.ch","url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128907/"},{"source":"vulnerability@ncsc.ch","url":"https://github.com/llorencroma/dji-aeroscope-root"},{"source":"vulnerability@ncsc.ch","url":"https://www.dji.com/aeroscope"}],"sourceIdentifier":"vulnerability@ncsc.ch","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"vulnerability@ncsc.ch","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128908.json b/data/2026/CVE-2026-128908.json
new file mode 100644
index 0000000000..b382af37f9
--- /dev/null
+++ b/data/2026/CVE-2026-128908.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","modules":["1300 DM810X communications board (uavmonitor_usbv1)"],"platforms":["ARM"],"product":"AeroScope Mobile (TP703)","programFiles":["opt/dvr_rdk/ti810x/bin/uavmonitor_usbv1"],"vendor":"DJI","versions":[{"status":"affected","version":"03.00.00.26","versionType":"custom"}]},{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","platforms":["ARM"],"product":"AeroScope Mobile (TP703) 1300 communications board firmware","programFiles":["opt/dvr_rdk/ti810x/bin/uavmonitor_usbv1"],"vendor":"DJI","versions":[{"lessThanOrEqual":"02.00.08.40","status":"affected","version":"02.00.07.12","versionType":"custom"}]}],"source":"vulnerability@ncsc.ch"}],"cveTags":[{"sourceIdentifier":"vulnerability@ncsc.ch","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to execute arbitrary commands as root. Configuration values that can be written without authentication over the management interface are inserted unquoted into shell commands. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The injected command persists across reboots. Confirmed on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available."}],"id":"CVE-2026-128908","lastModified":"2026-11-13T15:17:44.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"vulnerability@ncsc.ch","type":"Secondary"}]},"published":"2026-11-13T15:17:44.610","references":[{"source":"vulnerability@ncsc.ch","url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128908/"},{"source":"vulnerability@ncsc.ch","url":"https://github.com/llorencroma/dji-aeroscope-root"},{"source":"vulnerability@ncsc.ch","url":"https://www.dji.com/aeroscope"}],"sourceIdentifier":"vulnerability@ncsc.ch","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"vulnerability@ncsc.ch","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128909.json b/data/2026/CVE-2026-128909.json
new file mode 100644
index 0000000000..1d16b8fffb
--- /dev/null
+++ b/data/2026/CVE-2026-128909.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","modules":["1300 DM810X communications board (uavmonitor_usbv1)"],"platforms":["ARM"],"product":"AeroScope Mobile (TP703)","programFiles":["opt/dvr_rdk/ti810x/bin/uavmonitor_usbv1"],"vendor":"DJI","versions":[{"status":"affected","version":"03.00.00.26","versionType":"custom"}]},{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","platforms":["ARM"],"product":"AeroScope Mobile (TP703) 1300 communications board firmware","programFiles":["opt/dvr_rdk/ti810x/bin/uavmonitor_usbv1"],"vendor":"DJI","versions":[{"lessThanOrEqual":"02.00.08.40","status":"affected","version":"02.00.07.12","versionType":"custom"}]}],"source":"vulnerability@ncsc.ch"}],"cveTags":[{"sourceIdentifier":"vulnerability@ncsc.ch","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to install modified firmware, which gives persistent code execution as root. The device accepts any image that matches an MD5 checksum supplied in the same request and does not verify a signature. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available."}],"id":"CVE-2026-128909","lastModified":"2026-11-13T15:17:44.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"vulnerability@ncsc.ch","type":"Secondary"}]},"published":"2026-11-13T15:17:44.753","references":[{"source":"vulnerability@ncsc.ch","url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128909/"},{"source":"vulnerability@ncsc.ch","url":"https://github.com/llorencroma/dji-aeroscope-root"},{"source":"vulnerability@ncsc.ch","url":"https://www.dji.com/aeroscope"}],"sourceIdentifier":"vulnerability@ncsc.ch","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"},{"lang":"en","value":"CWE-494"}],"source":"vulnerability@ncsc.ch","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128910.json b/data/2026/CVE-2026-128910.json
new file mode 100644
index 0000000000..fc3d70c02a
--- /dev/null
+++ b/data/2026/CVE-2026-128910.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","modules":["1300 DM810X communications board (uavmonitor_usbv1; root console credential in /etc/shadow)"],"platforms":["ARM"],"product":"AeroScope Mobile (TP703)","programFiles":["etc/shadow","etc/passwd"],"vendor":"DJI","versions":[{"status":"affected","version":"03.00.00.26","versionType":"custom"}]},{"collectionURL":"https://www.dji.com","defaultStatus":"unknown","platforms":["ARM"],"product":"AeroScope Mobile (TP703) 1300 communications board firmware","vendor":"DJI","versions":[{"lessThanOrEqual":"02.00.08.40","status":"affected","version":"02.00.07.12","versionType":"custom"}]}],"source":"vulnerability@ncsc.ch"}],"cveTags":[{"sourceIdentifier":"vulnerability@ncsc.ch","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available."}],"id":"CVE-2026-128910","lastModified":"2026-11-13T15:17:44.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"vulnerability@ncsc.ch","type":"Secondary"}]},"published":"2026-11-13T15:17:44.900","references":[{"source":"vulnerability@ncsc.ch","url":"https://cyber-defence-campus.github.io/projects/vulnerabilities/CVE-2026-128910/"},{"source":"vulnerability@ncsc.ch","url":"https://github.com/llorencroma/dji-aeroscope-root"},{"source":"vulnerability@ncsc.ch","url":"https://www.dji.com/aeroscope"}],"sourceIdentifier":"vulnerability@ncsc.ch","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-521"},{"lang":"en","value":"CWE-798"},{"lang":"en","value":"CWE-916"}],"source":"vulnerability@ncsc.ch","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128970.json b/data/2026/CVE-2026-128970.json
new file mode 100644
index 0000000000..6e445f0094
--- /dev/null
+++ b/data/2026/CVE-2026-128970.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Psono Server Community Edition"],"product":"Psono","programFiles":["psono/restapi/serializers/delete_share_right.py"],"repo":"https://gitlab.com/esaqa/psono/psono-server","vendor":"esaqa GmbH","versions":[{"lessThan":"7.5.1","status":"affected","version":"1.12.6","versionType":"semver"}]},{"defaultStatus":"unaffected","modules":["Psono Server Enterprise Edition"],"product":"Psono","vendor":"esaqa GmbH","versions":[{"lessThan":"7.5.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"fdf66990-8419-4c8c-8848-ec15d75773b4"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13."}],"id":"CVE-2026-128970","lastModified":"2026-11-13T15:17:45.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","type":"Secondary"}]},"published":"2026-11-13T15:17:45.027","references":[{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","url":"https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-128970.md"},{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","url":"https://gitlab.com/esaqa/psono/psono-server"},{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","url":"https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/serializers/create_share_right.py"},{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","url":"https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/serializers/delete_share_right.py"},{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","url":"https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/views/membership_decline.py"},{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","url":"https://gitlab.com/esaqa/psono/psono-server/-/commit/11f9aa69dae370cd4f0213f4d03d1b1cc4df36dd"},{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","url":"https://gitlab.com/esaqa/psono/psono-server/-/commit/86e7ce7fdbb04fc4ae3430cc434179630948d48d"},{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","url":"https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.5.1"}],"sourceIdentifier":"fdf66990-8419-4c8c-8848-ec15d75773b4","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128990.json b/data/2026/CVE-2026-128990.json
new file mode 100644
index 0000000000..55504e50e7
--- /dev/null
+++ b/data/2026/CVE-2026-128990.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/stefanschippers/xschem","product":"xschem","repo":"https://github.com/StefanSchippers/xschem","vendor":"Stefan Schippers","versions":[{"lessThanOrEqual":"3.4.7","status":"affected","version":"2.9.9","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in read_dataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets, corrupting heap memory."}],"id":"CVE-2026-128990","lastModified":"2026-11-13T15:17:45.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T15:17:45.207","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/StefanSchippers/xschem"},{"source":"disclosure@vulncheck.com","url":"https://github.com/StefanSchippers/xschem/blob/3.4.7/src/rawtovcd.c#L124-L148"},{"source":"disclosure@vulncheck.com","url":"https://github.com/StefanSchippers/xschem/commit/e29af39c6133c36bdaf66603fd663231e75517f1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/xschem-2.9.9-through-3.4.7-heap-out-of-bounds-write-via-rawtovcd-read-dataset"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128991.json b/data/2026/CVE-2026-128991.json
new file mode 100644
index 0000000000..0ae02d6a92
--- /dev/null
+++ b/data/2026/CVE-2026-128991.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/stefanschippers/xschem","product":"xschem","repo":"https://github.com/StefanSchippers/xschem","vendor":"Stefan Schippers","versions":[{"lessThanOrEqual":"3.4.7","status":"affected","version":"2.9.9","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read_xschem_file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a \"[\" record, causing xschem to read and dereference memory below the instance array and crash."}],"id":"CVE-2026-128991","lastModified":"2026-11-13T15:17:45.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T15:17:45.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/StefanSchippers/xschem"},{"source":"disclosure@vulncheck.com","url":"https://github.com/StefanSchippers/xschem/blob/3.4.7/src/save.c#L3138-L3141"},{"source":"disclosure@vulncheck.com","url":"https://github.com/StefanSchippers/xschem/commit/e29af39c6133c36bdaf66603fd663231e75517f1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/xschem-2.9.9-through-3.4.7-out-of-bounds-read-via-read-xschem-file-embedded-symbol-record"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129092.json b/data/2026/CVE-2026-129092.json
new file mode 100644
index 0000000000..83b2b42d56
--- /dev/null
+++ b/data/2026/CVE-2026-129092.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/CCC-Attestation/attested-tls-poc","defaultStatus":"unaffected","packageURL":"pkg:github/ccc-attestation/attested-tls-poc","product":"attested-tls-poc","repo":"https://github.com/CCC-Attestation/attested-tls-poc","vendor":"CCC-Attestation","versions":[{"lessThanOrEqual":"731ca82ed533fc7a1092be980887ae2e34261da2","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake re-attestation. Attackers with local access to the attesting endpoint can alter workload code, data, configuration, or attached devices like GPUs while peers keep trusting the original Evidence."}],"id":"CVE-2026-129092","lastModified":"2026-11-13T15:17:45.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T15:17:45.513","references":[{"source":"disclosure@vulncheck.com","url":"https://doi.org/10.1145/3779208.3785387"},{"source":"disclosure@vulncheck.com","url":"https://github.com/CCC-Attestation/attested-tls-poc"},{"source":"disclosure@vulncheck.com","url":"https://github.com/CCC-Attestation/formal-spec-id-crisis"},{"source":"disclosure@vulncheck.com","url":"https://github.com/ionut-arm/mbedtls/blob/f4ac7593826a506fc509c83cad73786acab1d442/library/ssl_tls13_generic.c#L430-L436"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ccc-attestation-sig-attested-tls-poc-through-commit-731ca82-toctou-via-handshake-only-attestation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129094.json b/data/2026/CVE-2026-129094.json
new file mode 100644
index 0000000000..9fb2a7e7ce
--- /dev/null
+++ b/data/2026/CVE-2026-129094.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://www.npmjs.com/package/@utcp/http","defaultStatus":"unaffected","packageURL":"pkg:npm/%40utcp/http","product":"@utcp/http","repo":"https://github.com/universal-tool-calling-protocol/typescript-utcp","vendor":"universal-tool-calling-protocol","versions":[{"lessThan":"1.1.14","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a {host} placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE discovery to access internal services on the agent machine."}],"id":"CVE-2026-129094","lastModified":"2026-11-13T16:18:59.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:18:59.267","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/universal-tool-calling-protocol/typescript-utcp/pull/58"},{"source":"disclosure@vulncheck.com","url":"https://github.com/universal-tool-calling-protocol/typescript-utcp/pull/60"},{"source":"disclosure@vulncheck.com","url":"https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm"},{"source":"disclosure@vulncheck.com","url":"https://www.npmjs.com/package/@utcp/http"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/utcp-http-before-1.1.14-ssrf-to-loopback-via-host-placeholder-in-call-templates"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129099.json b/data/2026/CVE-2026-129099.json
new file mode 100644
index 0000000000..13b5f71ac8
--- /dev/null
+++ b/data/2026/CVE-2026-129099.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint."}],"id":"CVE-2026-129099","lastModified":"2026-11-13T16:18:59.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:18:59.440","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-root-rce-via-openvpn-configuration-import"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129100.json b/data/2026/CVE-2026-129100.json
new file mode 100644
index 0000000000..d8053c2b67
--- /dev/null
+++ b/data/2026/CVE-2026-129100.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject directives such as tls-verify that bypass the .ovpn denylist, and have OpenVPN execute the hook as root."}],"id":"CVE-2026-129100","lastModified":"2026-11-13T16:18:59.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:18:59.603","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-root-rce-via-openvpn-key-upload-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129101.json b/data/2026/CVE-2026-129101.json
new file mode 100644
index 0000000000..213dd4b1c0
--- /dev/null
+++ b/data/2026/CVE-2026-129101.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root."}],"id":"CVE-2026-129101","lastModified":"2026-11-13T16:18:59.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:18:59.763","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-authenticated-rce-via-vpn-set-conf-mass-assignment"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129102.json b/data/2026/CVE-2026-129102.json
new file mode 100644
index 0000000000..1e9eec39a7
--- /dev/null
+++ b/data/2026/CVE-2026-129102.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA."}],"id":"CVE-2026-129102","lastModified":"2026-11-13T16:18:59.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:18:59.923","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-vpn-set-conf-ipsec-keyexchange"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129103.json b/data/2026/CVE-2026-129103.json
new file mode 100644
index 0000000000..eb1e629804
--- /dev/null
+++ b/data/2026/CVE-2026-129103.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run."}],"id":"CVE-2026-129103","lastModified":"2026-11-13T16:19:00.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:19:00.083","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-scheduled-reboot-time"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129104.json b/data/2026/CVE-2026-129104.json
new file mode 100644
index 0000000000..75bb01f8c5
--- /dev/null
+++ b/data/2026/CVE-2026-129104.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq."}],"id":"CVE-2026-129104","lastModified":"2026-11-13T16:19:00.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:19:00.240","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-dnsmasq-configuration-injection-via-net-set-dhcp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129105.json b/data/2026/CVE-2026-129105.json
new file mode 100644
index 0000000000..75f5188be8
--- /dev/null
+++ b/data/2026/CVE-2026-129105.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process."}],"id":"CVE-2026-129105","lastModified":"2026-11-13T16:19:00.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:19:00.397","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-pppd-option-injection-via-net-set-wan-l2tp-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129110.json b/data/2026/CVE-2026-129110.json
new file mode 100644
index 0000000000..0a1330a106
--- /dev/null
+++ b/data/2026/CVE-2026-129110.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/nuxsmin/syspass","product":"sysPass","repo":"https://github.com/nuxsmin/sysPass","vendor":"nuxsmin","versions":[{"lessThanOrEqual":"3.2.11","status":"affected","version":"3.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands."}],"id":"CVE-2026-129110","lastModified":"2026-11-13T16:19:00.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:19:00.543","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpusProjects/sysPass/pull/360"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nuxsmin/sysPass"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nuxsmin/sysPass/blob/3.2.11/app/modules/web/Controllers/InstallController.php#L80-L110"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nuxsmin/sysPass/issues/1954"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/syspass-3.0.1-through-3.2.11-unauthenticated-reinstallation-rce-via-install-install"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-14447.json b/data/2026/CVE-2026-14447.json
index 54e7d9167f..29908c45b0 100644
--- a/data/2026/CVE-2026-14447.json
+++ b/data/2026/CVE-2026-14447.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-14447","lastModified":"2026-11-10T21:46:42.730","metrics":{},"published":"2026-11-10T20:19:10.460","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-14447","lastModified":"2026-11-13T16:19:00.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-14447","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:25:30.426205Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:10.460","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-16659.json b/data/2026/CVE-2026-16659.json
index b670702fb4..0c6a63bcb9 100644
--- a/data/2026/CVE-2026-16659.json
+++ b/data/2026/CVE-2026-16659.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/boot_serial/src/boot_serial.c","boot/boot_serial/src/boot_serial_encryption.c"],"programRoutines":[{"name":"boot_handle_enc_fw"},{"name":"bs_upload"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MCUboot's serial-recovery image-upload handler bs_upload() in boot/boot_serial/src/boot_serial.c declares const struct flash_area *fap = NULL and assigns it only via flash_area_open() part-way through the function. Two early validation failures (goto out_invalid_data) — a CBOR map that fails to decode, or an upload packet missing the off/data members — branch past the open while fap is still NULL, then fall into the shared epilogue. In MCUBOOT_ENC_IMAGES builds that epilogue unconditionally calls boot_handle_enc_fw(fap), which reaches boot_image_load_header() and flash_area_read() and dereferences the NULL flash_area.\n\nThe defect is reachable pre-authentication: the trigger is the very first serial-recovery upload command carrying a malformed payload. The guarding conditions are default-true on a fresh recovery session — img_num, curr_off and img_size are zero-initialized statics, so curr_off == img_size and the primary-slot test both hold. It requires a non-default build: encrypted images (MCUBOOT_ENC_IMAGES / Zephyr CONFIG_BOOT_ENCRYPT_IMAGE) together with an active serial-recovery transport, on the Zephyr or Mynewt port (the two that build both boot/boot_serial/src/boot_serial.c and boot_serial_encryption.c with MCUBOOT_ENC_IMAGES).\n\nThe impact is a transient denial of service of the bootloader during recovery. fap is a hard NULL rather than an attacker-controlled value, so there is no memory-corruption or information-leak primitive and image authentication is unaffected. Whether the dereference faults is platform-dependent — on targets where address 0x0 is mapped readable flash the read merely returns an error and execution continues, while targets that trap NULL (MPU / null-pointer-exception detection) take a hard fault. Because serial recovery is unauthenticated by design and already permits the console attacker to write the secondary slot, the added capability is only a low-value transient crash.\n\nThe related unconditional flash_area_close(fap) call in the same epilogue is a safe no-op on the ports that reach it, so it does not contribute to the dereference.\n\nThe affected ports are the Zephyr port — boot/zephyr/CMakeLists.txt compiles boot_serial.c under CONFIG_MCUBOOT_SERIAL and boot_serial_encryption.c under CONFIG_BOOT_ENCRYPT_IMAGE — and the Mynewt port, whose mcuboot_config.h defines MCUBOOT_SERIAL unconditionally and MCUBOOT_ENC_IMAGES under any BOOTUTIL_ENCRYPT_ syscfg, with boot/boot_serial/pkg.yml declaring no explicit source list so the whole directory is built. The Espressif port is not affected**: it compiles boot_serial.c but not boot_serial_encryption.c, and defines no MCUBOOT_ENC_IMAGES, so the #ifdef MCUBOOT_ENC_IMAGES block containing the call is preprocessed away. The NuttX, Cypress and Mbed ports do not build boot_serial.c at all."}],"id":"CVE-2026-16659","lastModified":"2026-11-13T02:18:56.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:56.880","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/400f9a7242641655948b08acac19932f56d9881f"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-777r-3chm-p78c"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/boot_serial/src/boot_serial.c","boot/boot_serial/src/boot_serial_encryption.c"],"programRoutines":[{"name":"boot_handle_enc_fw"},{"name":"bs_upload"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MCUboot's serial-recovery image-upload handler bs_upload() in boot/boot_serial/src/boot_serial.c declares const struct flash_area *fap = NULL and assigns it only via flash_area_open() part-way through the function. Two early validation failures (goto out_invalid_data) — a CBOR map that fails to decode, or an upload packet missing the off/data members — branch past the open while fap is still NULL, then fall into the shared epilogue. In MCUBOOT_ENC_IMAGES builds that epilogue unconditionally calls boot_handle_enc_fw(fap), which reaches boot_image_load_header() and flash_area_read() and dereferences the NULL flash_area.\n\nThe defect is reachable pre-authentication: the trigger is the very first serial-recovery upload command carrying a malformed payload. The guarding conditions are default-true on a fresh recovery session — img_num, curr_off and img_size are zero-initialized statics, so curr_off == img_size and the primary-slot test both hold. It requires a non-default build: encrypted images (MCUBOOT_ENC_IMAGES / Zephyr CONFIG_BOOT_ENCRYPT_IMAGE) together with an active serial-recovery transport, on the Zephyr or Mynewt port (the two that build both boot/boot_serial/src/boot_serial.c and boot_serial_encryption.c with MCUBOOT_ENC_IMAGES).\n\nThe impact is a transient denial of service of the bootloader during recovery. fap is a hard NULL rather than an attacker-controlled value, so there is no memory-corruption or information-leak primitive and image authentication is unaffected. Whether the dereference faults is platform-dependent — on targets where address 0x0 is mapped readable flash the read merely returns an error and execution continues, while targets that trap NULL (MPU / null-pointer-exception detection) take a hard fault. Because serial recovery is unauthenticated by design and already permits the console attacker to write the secondary slot, the added capability is only a low-value transient crash.\n\nThe related unconditional flash_area_close(fap) call in the same epilogue is a safe no-op on the ports that reach it, so it does not contribute to the dereference.\n\nThe affected ports are the Zephyr port — boot/zephyr/CMakeLists.txt compiles boot_serial.c under CONFIG_MCUBOOT_SERIAL and boot_serial_encryption.c under CONFIG_BOOT_ENCRYPT_IMAGE — and the Mynewt port, whose mcuboot_config.h defines MCUBOOT_SERIAL unconditionally and MCUBOOT_ENC_IMAGES under any BOOTUTIL_ENCRYPT_ syscfg, with boot/boot_serial/pkg.yml declaring no explicit source list so the whole directory is built. The Espressif port is not affected**: it compiles boot_serial.c but not boot_serial_encryption.c, and defines no MCUBOOT_ENC_IMAGES, so the #ifdef MCUBOOT_ENC_IMAGES block containing the call is preprocessed away. The NuttX, Cypress and Mbed ports do not build boot_serial.c at all."}],"id":"CVE-2026-16659","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:56.880","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/400f9a7242641655948b08acac19932f56d9881f"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-777r-3chm-p78c"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-16662.json b/data/2026/CVE-2026-16662.json
index 0c518cf6e8..c882a0f4e9 100644
--- a/data/2026/CVE-2026-16662.json
+++ b/data/2026/CVE-2026-16662.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/src/boot_record.c"],"programRoutines":[{"name":"boot_save_boot_status"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"1.6.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) and then reads exactly len bytes, so a TLV shorter than IMAGE_HASH_SIZE leaves the tail of image_hash holding stale stack content. The subsequent copy into the boot record, memcpy(buf + offset, image_hash, sizeof(image_hash)), uses the fixed buffer size rather than len, so up to IMAGE_HASH_SIZE - 1 bytes of uninitialised bootloader stack are written into the measured-boot record.\n\nThe defect is reachable only under MCUBOOT_MEASURED_BOOT, and only when the image reaching boot_save_boot_status() was not hash-validated on that boot. bootutil_img_validate() rejects a hash TLV whose length is not exactly sizeof(hash) (boot/bootutil/src/image_validate.c:345), and primary-slot validation is on by default (Zephyr's CONFIG_BOOT_VALIDATE_SLOT0 defaults to y), so in a default build the malformed image never reaches this code. The direct-XIP and RAM-load strategies in boot/bootutil/src/loader.c validate the selected slot unconditionally and are not affected. The short TLV survives only where the integrator has turned primary-slot validation off: the swap and overwrite loader built without MCUBOOT_VALIDATE_PRIMARY_SLOT, which checks only the image magic before calling boot_add_shared_data(), and the Zephyr single-slot loader (boot/zephyr/single_loader.c) built without it, including the MCUBOOT_VALIDATE_PRIMARY_SLOT_ONCE variant, which skips validation once the trailer records an earlier successful one. It is also reachable through a time-of-check/time-of-use change to tamperable external flash between validation and the boot-record read. Placing the crafted image requires physical or flash-write access to the device; in a single-slot build with serial recovery enabled, the serial-recovery upload writes the primary slot directly and can place it as well.\n\nIn these configurations the boot record's measurement is already not trustworthy: with validation off, the hash copied into the record is the image's own unverified EXPECTED_HASH_TLV, which the attacker chooses. The defect therefore does not weaken attestation integrity any further. What it adds is a path for bootloader memory to leave the device: up to 63 bytes (IMAGE_HASH_SIZE - 1) of uninitialised bootloader stack are embedded in the measurement field that a downstream attestation service sends to a remote verifier. In the configurations analysed the residue is bootloader internal state (TLV offsets and lengths, flash addresses, loop state), not key material, but what occupies that stack region depends on configuration and on which code ran before boot_save_boot_status(). It is reported as a low-severity, defense-in-depth disclosure with no integrity or availability impact.\n\nThis is distinct from the already-fixed record_len integer underflow in the same routine (GHSA-8hrv-4cp5-4rg3). The fix rejects any EXPECTED_HASH_TLV whose length is not exactly IMAGE_HASH_SIZE."}],"id":"CVE-2026-16662","lastModified":"2026-11-13T02:18:57.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":2.4,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:57.027","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/5098d8eef1139abd3d821d8138a6321d656dcd3e"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-779w-4x76-5chf"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-457"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/src/boot_record.c"],"programRoutines":[{"name":"boot_save_boot_status"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"1.6.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) and then reads exactly len bytes, so a TLV shorter than IMAGE_HASH_SIZE leaves the tail of image_hash holding stale stack content. The subsequent copy into the boot record, memcpy(buf + offset, image_hash, sizeof(image_hash)), uses the fixed buffer size rather than len, so up to IMAGE_HASH_SIZE - 1 bytes of uninitialised bootloader stack are written into the measured-boot record.\n\nThe defect is reachable only under MCUBOOT_MEASURED_BOOT, and only when the image reaching boot_save_boot_status() was not hash-validated on that boot. bootutil_img_validate() rejects a hash TLV whose length is not exactly sizeof(hash) (boot/bootutil/src/image_validate.c:345), and primary-slot validation is on by default (Zephyr's CONFIG_BOOT_VALIDATE_SLOT0 defaults to y), so in a default build the malformed image never reaches this code. The direct-XIP and RAM-load strategies in boot/bootutil/src/loader.c validate the selected slot unconditionally and are not affected. The short TLV survives only where the integrator has turned primary-slot validation off: the swap and overwrite loader built without MCUBOOT_VALIDATE_PRIMARY_SLOT, which checks only the image magic before calling boot_add_shared_data(), and the Zephyr single-slot loader (boot/zephyr/single_loader.c) built without it, including the MCUBOOT_VALIDATE_PRIMARY_SLOT_ONCE variant, which skips validation once the trailer records an earlier successful one. It is also reachable through a time-of-check/time-of-use change to tamperable external flash between validation and the boot-record read. Placing the crafted image requires physical or flash-write access to the device; in a single-slot build with serial recovery enabled, the serial-recovery upload writes the primary slot directly and can place it as well.\n\nIn these configurations the boot record's measurement is already not trustworthy: with validation off, the hash copied into the record is the image's own unverified EXPECTED_HASH_TLV, which the attacker chooses. The defect therefore does not weaken attestation integrity any further. What it adds is a path for bootloader memory to leave the device: up to 63 bytes (IMAGE_HASH_SIZE - 1) of uninitialised bootloader stack are embedded in the measurement field that a downstream attestation service sends to a remote verifier. In the configurations analysed the residue is bootloader internal state (TLV offsets and lengths, flash addresses, loop state), not key material, but what occupies that stack region depends on configuration and on which code ran before boot_save_boot_status(). It is reported as a low-severity, defense-in-depth disclosure with no integrity or availability impact.\n\nThis is distinct from the already-fixed record_len integer underflow in the same routine (GHSA-8hrv-4cp5-4rg3). The fix rejects any EXPECTED_HASH_TLV whose length is not exactly IMAGE_HASH_SIZE."}],"id":"CVE-2026-16662","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":2.4,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:57.027","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/5098d8eef1139abd3d821d8138a6321d656dcd3e"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-779w-4x76-5chf"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-457"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-16664.json b/data/2026/CVE-2026-16664.json
index aae7844e7d..789bd18f2e 100644
--- a/data/2026/CVE-2026-16664.json
+++ b/data/2026/CVE-2026-16664.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/boot_serial/src/boot_serial.c","boot/zephyr/include/sysflash/sysflash.h"],"programRoutines":[{"name":"__flash_area_ids_for_slot"},{"name":"bs_upload"}],"vendor":"mcu-tools","versions":[{"lessThanOrEqual":"*","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img_num (a full 32-bit value) and latches it on the off == 0 packet without any range check. It then passes img_num straight to flash_area_id_from_multi_image_slot(img_num, 0), which on the Zephyr port resolves to __flash_area_ids_for_slot() in boot/zephyr/include/sysflash/sysflash.h and indexes the static const int all_slots[] table as all_slots[img_num  2]. That table holds only MCUBOOT_IMAGE_NUMBER  2 entries, so any img_num >= MCUBOOT_IMAGE_NUMBER is an out-of-bounds read.\n\nThe path is reachable by anyone with access to the serial / SMP recovery console, which is unauthenticated by design, and the bad value is supplied before any image signature is verified. The defect is specific to the default non-direct upload path (MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD disabled) on the Zephyr port with the array-backed slot layout (not CONFIG_SINGLE_APPLICATION_SLOT). It is not gated on a multi-image configuration: MCUBOOT_IMAGE_NUMBER defaults to 1, so even a default single-image build is affected for any image >= 1. The MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD path is safe (its flash_area_id_from_direct_image() switch returns -EINVAL for unknown indices).\n\nflash_area_id_from_multi_image_slot() takes a signed int image_index while img_num is uint32_t, so the attacker controls the sign of the index as well as its magnitude: an image of 0xFFFFFFFF converts to -1 and reads all_slots[-2], off the front of the table, while large positive values read off the end (CWE-192). Either way the index multiply img * 2 is performed in int, so a wild offset yields a bus/hard fault, giving a reliable denial of service of the bootloader during recovery. For moderately out-of-range indices the read returns adjacent .rodata as a garbage flash-area id that is handed to flash_area_open(); this normally fails with MGMT_ERR_EINVAL, but if the garbage id happens to match a valid non-image partition, the subsequent erase/write can target a partition outside the image set (CWE-787). The attacker-supplied value is never echoed back, so there is no information disclosure. The fix is to reject img_num >= BOOT_IMAGE_NUMBER on the off == 0 packet, before the slot lookup. The comparison must be made on the unsigned img_num: an equivalent guard applied after the conversion to int would not reject the negative case above. __flash_area_ids_for_slot() should bounds-check its own arguments as defence in depth.\nThis vulnerability was reported independently twice: by NVIDIA Project Vanessa on 2026-06-22, and by Kai Phan (@kaimandalic) on 2026-07-19 as GHSA-8v33-88p6-jffj, which is closed as a duplicate of this advisory. Both original reports are reproduced in full below."}],"id":"CVE-2026-16664","lastModified":"2026-11-13T02:18:57.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":2.5,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:57.163","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/183a05f256bdbbac86edcb048958da59018f814e"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-8rcq-2mgr-fhp8"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/boot_serial/src/boot_serial.c","boot/zephyr/include/sysflash/sysflash.h"],"programRoutines":[{"name":"__flash_area_ids_for_slot"},{"name":"bs_upload"}],"vendor":"mcu-tools","versions":[{"lessThanOrEqual":"*","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img_num (a full 32-bit value) and latches it on the off == 0 packet without any range check. It then passes img_num straight to flash_area_id_from_multi_image_slot(img_num, 0), which on the Zephyr port resolves to __flash_area_ids_for_slot() in boot/zephyr/include/sysflash/sysflash.h and indexes the static const int all_slots[] table as all_slots[img_num  2]. That table holds only MCUBOOT_IMAGE_NUMBER  2 entries, so any img_num >= MCUBOOT_IMAGE_NUMBER is an out-of-bounds read.\n\nThe path is reachable by anyone with access to the serial / SMP recovery console, which is unauthenticated by design, and the bad value is supplied before any image signature is verified. The defect is specific to the default non-direct upload path (MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD disabled) on the Zephyr port with the array-backed slot layout (not CONFIG_SINGLE_APPLICATION_SLOT). It is not gated on a multi-image configuration: MCUBOOT_IMAGE_NUMBER defaults to 1, so even a default single-image build is affected for any image >= 1. The MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD path is safe (its flash_area_id_from_direct_image() switch returns -EINVAL for unknown indices).\n\nflash_area_id_from_multi_image_slot() takes a signed int image_index while img_num is uint32_t, so the attacker controls the sign of the index as well as its magnitude: an image of 0xFFFFFFFF converts to -1 and reads all_slots[-2], off the front of the table, while large positive values read off the end (CWE-192). Either way the index multiply img * 2 is performed in int, so a wild offset yields a bus/hard fault, giving a reliable denial of service of the bootloader during recovery. For moderately out-of-range indices the read returns adjacent .rodata as a garbage flash-area id that is handed to flash_area_open(); this normally fails with MGMT_ERR_EINVAL, but if the garbage id happens to match a valid non-image partition, the subsequent erase/write can target a partition outside the image set (CWE-787). The attacker-supplied value is never echoed back, so there is no information disclosure. The fix is to reject img_num >= BOOT_IMAGE_NUMBER on the off == 0 packet, before the slot lookup. The comparison must be made on the unsigned img_num: an equivalent guard applied after the conversion to int would not reject the negative case above. __flash_area_ids_for_slot() should bounds-check its own arguments as defence in depth.\nThis vulnerability was reported independently twice: by NVIDIA Project Vanessa on 2026-06-22, and by Kai Phan (@kaimandalic) on 2026-07-19 as GHSA-8v33-88p6-jffj, which is closed as a duplicate of this advisory. Both original reports are reproduced in full below."}],"id":"CVE-2026-16664","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":2.5,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:57.163","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/183a05f256bdbbac86edcb048958da59018f814e"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-8rcq-2mgr-fhp8"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-16671.json b/data/2026/CVE-2026-16671.json
index 949fa2807e..1827f8fd1e 100644
--- a/data/2026/CVE-2026-16671.json
+++ b/data/2026/CVE-2026-16671.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/src/image_validate.c","boot/bootutil/src/loader.c"],"programRoutines":[{"name":"split_go"},{"name":"split_image_check"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the out_hash out-parameter to bootutil_img_validate(). That routine copies IMAGE_HASH_SIZE bytes into out_hash (memcpy(out_hash, hash, IMAGE_HASH_SIZE) in boot/bootutil/src/image_validate.c), where IMAGE_HASH_SIZE is a compile-time constant of 64 for MCUBOOT_SHA512 or 48 for MCUBOOT_SIGN_EC384/SHA-384 (boot/bootutil/include/bootutil/crypto/sha.h). The buffer tracks SHA-256 (32 bytes) while the copy length tracks the configured algorithm, so the write overruns the buffer by 16 or 32 bytes.\n\nThe overflow is only present in a non-default configuration: the legacy Mynewt split-image feature must be compiled (split_go()/split_image_check(), i.e. neither MCUBOOT_DIRECT_XIP nor MCUBOOT_RAM_LOAD), the digest must be larger than 32 bytes (MCUBOOT_SHA512 or MCUBOOT_SIGN_EC384), and MCUBOOT_SIGN_PURE must be off. split_go() is a public API with no caller inside MCUboot; it is invoked from a Mynewt application. In the default SHA-256 build there is no overflow.\n\nThe over-written bytes are the one-way digest of the loader image and the overflow length is fixed at build time, so the contents are not meaningfully attacker-controlled and the size is not attacker-chosen. The realistic impact is bounded, uncontrolled corruption of the bootloader's stack on the split-boot path, manifesting as instability or failed boot in the affected configuration rather than reliable code execution. The fix is to size loader_hash to IMAGE_HASH_SIZE and pass IMAGE_HASH_SIZE as the matching seed length."}],"id":"CVE-2026-16671","lastModified":"2026-11-13T02:18:57.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:57.647","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/9fb70f00173766d73cdadd82266bd61e4ddd0252"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-vj6q-r752-fpqv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/mcu-tools/mcuboot","defaultStatus":"unaffected","packageName":"mcuboot","product":"mcuboot","programFiles":["boot/bootutil/src/image_validate.c","boot/bootutil/src/loader.c"],"programRoutines":[{"name":"split_go"},{"name":"split_image_check"}],"vendor":"mcu-tools","versions":[{"lessThan":"2.5.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the out_hash out-parameter to bootutil_img_validate(). That routine copies IMAGE_HASH_SIZE bytes into out_hash (memcpy(out_hash, hash, IMAGE_HASH_SIZE) in boot/bootutil/src/image_validate.c), where IMAGE_HASH_SIZE is a compile-time constant of 64 for MCUBOOT_SHA512 or 48 for MCUBOOT_SIGN_EC384/SHA-384 (boot/bootutil/include/bootutil/crypto/sha.h). The buffer tracks SHA-256 (32 bytes) while the copy length tracks the configured algorithm, so the write overruns the buffer by 16 or 32 bytes.\n\nThe overflow is only present in a non-default configuration: the legacy Mynewt split-image feature must be compiled (split_go()/split_image_check(), i.e. neither MCUBOOT_DIRECT_XIP nor MCUBOOT_RAM_LOAD), the digest must be larger than 32 bytes (MCUBOOT_SHA512 or MCUBOOT_SIGN_EC384), and MCUBOOT_SIGN_PURE must be off. split_go() is a public API with no caller inside MCUboot; it is invoked from a Mynewt application. In the default SHA-256 build there is no overflow.\n\nThe over-written bytes are the one-way digest of the loader image and the overflow length is fixed at build time, so the contents are not meaningfully attacker-controlled and the size is not attacker-chosen. The realistic impact is bounded, uncontrolled corruption of the bootloader's stack on the split-boot path, manifesting as instability or failed boot in the affected configuration rather than reliable code execution. The fix is to size loader_hash to IMAGE_HASH_SIZE and pass IMAGE_HASH_SIZE as the matching seed length."}],"id":"CVE-2026-16671","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T02:18:57.647","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/commit/9fb70f00173766d73cdadd82266bd61e4ddd0252"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-vj6q-r752-fpqv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-16709.json b/data/2026/CVE-2026-16709.json
index bcb9839957..a876bc0735 100644
--- a/data/2026/CVE-2026-16709.json
+++ b/data/2026/CVE-2026-16709.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session."}],"id":"CVE-2026-16709","lastModified":"2026-11-10T17:00:34.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:19.730","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session."}],"id":"CVE-2026-16709","lastModified":"2026-11-13T15:17:46.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-16709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:41:48.467858Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:19.730","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-16716.json b/data/2026/CVE-2026-16716.json
index 61943f311f..6bf57e88e3 100644
--- a/data/2026/CVE-2026-16716.json
+++ b/data/2026/CVE-2026-16716.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment."}],"id":"CVE-2026-16716","lastModified":"2026-11-10T16:59:31.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:20.733","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1259"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment."}],"id":"CVE-2026-16716","lastModified":"2026-11-13T15:17:46.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-16716","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:49:00.981436Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:20.733","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1259"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-16720.json b/data/2026/CVE-2026-16720.json
index 7a42a03cc7..3744230e33 100644
--- a/data/2026/CVE-2026-16720.json
+++ b/data/2026/CVE-2026-16720.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed."}],"id":"CVE-2026-16720","lastModified":"2026-11-10T16:56:41.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:21.883","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed."}],"id":"CVE-2026-16720","lastModified":"2026-11-13T15:17:46.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-16720","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:53:10.291645Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:21.883","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17284.json b/data/2026/CVE-2026-17284.json
index da265392d0..a4bfff23aa 100644
--- a/data/2026/CVE-2026-17284.json
+++ b/data/2026/CVE-2026-17284.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants."}],"id":"CVE-2026-17284","lastModified":"2026-11-10T16:52:37.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-11-07T05:18:34.737","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants."}],"id":"CVE-2026-17284","lastModified":"2026-11-13T15:17:46.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17284","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:33:30.405352Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:34.737","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17290.json b/data/2026/CVE-2026-17290.json
index 1ab82cff55..1bb547a159 100644
--- a/data/2026/CVE-2026-17290.json
+++ b/data/2026/CVE-2026-17290.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts."}],"id":"CVE-2026-17290","lastModified":"2026-11-10T16:26:01.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:35.867","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts."}],"id":"CVE-2026-17290","lastModified":"2026-11-13T15:17:46.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17290","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:42:50.082453Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:35.867","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17293.json b/data/2026/CVE-2026-17293.json
index fc37d75c98..00c531ec3f 100644
--- a/data/2026/CVE-2026-17293.json
+++ b/data/2026/CVE-2026-17293.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile."}],"id":"CVE-2026-17293","lastModified":"2026-11-10T16:24:29.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:36.570","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile."}],"id":"CVE-2026-17293","lastModified":"2026-11-13T15:17:46.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:38:16.318196Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:36.570","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17299.json b/data/2026/CVE-2026-17299.json
index cf91b0451b..fa7f50f786 100644
--- a/data/2026/CVE-2026-17299.json
+++ b/data/2026/CVE-2026-17299.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker."}],"id":"CVE-2026-17299","lastModified":"2026-11-10T16:22:12.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-11-07T05:18:37.700","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker."}],"id":"CVE-2026-17299","lastModified":"2026-11-13T15:17:46.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17299","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:37:16.786058Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:37.700","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17301.json b/data/2026/CVE-2026-17301.json
index a7ff8170f5..c4276c7f49 100644
--- a/data/2026/CVE-2026-17301.json
+++ b/data/2026/CVE-2026-17301.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature."}],"id":"CVE-2026-17301","lastModified":"2026-11-10T16:22:05.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:37.913","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature."}],"id":"CVE-2026-17301","lastModified":"2026-11-13T15:17:46.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17301","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:54:15.999209Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:37.913","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17326.json b/data/2026/CVE-2026-17326.json
index 29911f4950..c732c1d0de 100644
--- a/data/2026/CVE-2026-17326.json
+++ b/data/2026/CVE-2026-17326.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication."}],"id":"CVE-2026-17326","lastModified":"2026-11-07T05:18:42.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:42.697","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication."}],"id":"CVE-2026-17326","lastModified":"2026-11-13T15:17:47.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17326","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:50:00.946695Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:42.697","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17356.json b/data/2026/CVE-2026-17356.json
index 68c768abb6..a04ab208be 100644
--- a/data/2026/CVE-2026-17356.json
+++ b/data/2026/CVE-2026-17356.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key."}],"id":"CVE-2026-17356","lastModified":"2026-11-07T05:18:47.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:47.447","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key."}],"id":"CVE-2026-17356","lastModified":"2026-11-13T15:17:47.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:32:30.666822Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:47.447","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17390.json b/data/2026/CVE-2026-17390.json
index 1c9f9b8a62..7b2aecf557 100644
--- a/data/2026/CVE-2026-17390.json
+++ b/data/2026/CVE-2026-17390.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session."}],"id":"CVE-2026-17390","lastModified":"2026-11-07T05:18:53.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:53.700","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session."}],"id":"CVE-2026-17390","lastModified":"2026-11-13T15:17:47.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17390","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:00:10.553047Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:53.700","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17395.json b/data/2026/CVE-2026-17395.json
index 4330e8290e..9333ad2600 100644
--- a/data/2026/CVE-2026-17395.json
+++ b/data/2026/CVE-2026-17395.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems."}],"id":"CVE-2026-17395","lastModified":"2026-11-07T05:18:55.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:54.853","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems."}],"id":"CVE-2026-17395","lastModified":"2026-11-13T15:17:47.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:51:10.892215Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:54.853","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17407.json b/data/2026/CVE-2026-17407.json
index 1b1a5d18f2..9870b93f97 100644
--- a/data/2026/CVE-2026-17407.json
+++ b/data/2026/CVE-2026-17407.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run."}],"id":"CVE-2026-17407","lastModified":"2026-11-07T05:18:57.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:57.670","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run."}],"id":"CVE-2026-17407","lastModified":"2026-11-13T15:17:47.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:39:40.657862Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:57.670","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17410.json b/data/2026/CVE-2026-17410.json
index 95de794dcd..a055c044e8 100644
--- a/data/2026/CVE-2026-17410.json
+++ b/data/2026/CVE-2026-17410.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters."}],"id":"CVE-2026-17410","lastModified":"2026-11-07T05:18:58.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:58.410","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters."}],"id":"CVE-2026-17410","lastModified":"2026-11-13T15:17:47.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17410","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:52:07.276315Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:58.410","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-17411.json b/data/2026/CVE-2026-17411.json
index 620fe33c66..d8c13a0743 100644
--- a/data/2026/CVE-2026-17411.json
+++ b/data/2026/CVE-2026-17411.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries."}],"id":"CVE-2026-17411","lastModified":"2026-11-07T05:18:58.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:58.650","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries."}],"id":"CVE-2026-17411","lastModified":"2026-11-13T15:17:48.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17411","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:01:08.941190Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:58.650","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-19121.json b/data/2026/CVE-2026-19121.json
index ca53e1f94e..9cbcc8818f 100644
--- a/data/2026/CVE-2026-19121.json
+++ b/data/2026/CVE-2026-19121.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources."}],"id":"CVE-2026-19121","lastModified":"2026-11-07T05:19:00.093","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:59.963","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources."}],"id":"CVE-2026-19121","lastModified":"2026-11-13T15:17:48.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-19121","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:23:34.705753Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:59.963","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-19122.json b/data/2026/CVE-2026-19122.json
index 3e7b5c4d61..42178532a4 100644
--- a/data/2026/CVE-2026-19122.json
+++ b/data/2026/CVE-2026-19122.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks."}],"id":"CVE-2026-19122","lastModified":"2026-11-07T05:19:00.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:19:00.137","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks."}],"id":"CVE-2026-19122","lastModified":"2026-11-13T15:17:48.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-19122","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:21:42.217966Z","version":"2.0.3"}}]},"published":"2026-11-07T05:19:00.137","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-19129.json b/data/2026/CVE-2026-19129.json
index f8138be7eb..e4c9208524 100644
--- a/data/2026/CVE-2026-19129.json
+++ b/data/2026/CVE-2026-19129.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted."}],"id":"CVE-2026-19129","lastModified":"2026-11-07T05:19:01.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:19:00.917","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted."}],"id":"CVE-2026-19129","lastModified":"2026-11-13T15:17:48.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-19129","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:59:10.791401Z","version":"2.0.3"}}]},"published":"2026-11-07T05:19:00.917","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-21407.json b/data/2026/CVE-2026-21407.json
index eeba8b68bb..e182faec3f 100644
--- a/data/2026/CVE-2026-21407.json
+++ b/data/2026/CVE-2026-21407.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Arc(TM) B-series graphics cards","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deadlock for some Intel(R) Arc(TM) B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-21407","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:34.193","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01440.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-833"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Arc(TM) B-series graphics cards","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deadlock for some Intel(R) Arc(TM) B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-21407","lastModified":"2026-11-13T15:17:48.863","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-21407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:55.464295Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:34.193","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01440.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-833"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-24799.json b/data/2026/CVE-2026-24799.json
index 622b3288d2..9fb1b8f09c 100644
--- a/data/2026/CVE-2026-24799.json
+++ b/data/2026/CVE-2026-24799.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/davisking/dlib","defaultStatus":"affected","modules":["dlib/external/zlib"],"product":"dlib","programFiles":["inflate.c"],"vendor":"davisking","versions":[{"lessThan":"v19.24.9","status":"affected","version":"0","versionType":"git"}]}],"source":"cve_disclosure@tech.gov.sg"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects dlib: before v19.24.9."},{"lang":"es","value":"Escritura fuera de límites, Copia de búfer sin verificar el tamaño de la entrada ('Desbordamiento de búfer clásico') vulnerabilidad en davisking dlib (módulos dlib/external/zlib). Esta vulnerabilidad está asociada con los archivos de programa inflate.C.\n\nEste problema afecta a dlib: antes de la v19.24.9."}],"id":"CVE-2026-24799","lastModified":"2026-06-17T10:23:36.620","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-24799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-01-27T15:29:05.640071Z","version":"2.0.3"}}]},"published":"2026-01-27T09:15:49.787","references":[{"source":"cve_disclosure@tech.gov.sg","url":"https://github.com/davisking/dlib/pull/3063"}],"sourceIdentifier":"cve_disclosure@tech.gov.sg","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"},{"lang":"en","value":"CWE-787"}],"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/davisking/dlib","defaultStatus":"affected","modules":["dlib/external/zlib"],"product":"dlib","programFiles":["inflate.c"],"vendor":"davisking","versions":[{"lessThan":"v19.24.9","status":"affected","version":"0","versionType":"git"}]}],"source":"cve_disclosure@tech.gov.sg"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects dlib: before v19.24.9."},{"lang":"es","value":"Escritura fuera de límites, Copia de búfer sin verificar el tamaño de la entrada ('Desbordamiento de búfer clásico') vulnerabilidad en davisking dlib (módulos dlib/external/zlib). Esta vulnerabilidad está asociada con los archivos de programa inflate.C.\n\nEste problema afecta a dlib: antes de la v19.24.9."}],"id":"CVE-2026-24799","lastModified":"2026-11-13T16:07:36.783","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-24799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-01-27T15:29:05.640071Z","version":"2.0.3"}}]},"published":"2026-01-27T09:15:49.787","references":[{"source":"cve_disclosure@tech.gov.sg","url":"https://github.com/davisking/dlib/pull/3063"}],"sourceIdentifier":"cve_disclosure@tech.gov.sg","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"},{"lang":"en","value":"CWE-787"}],"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-28743.json b/data/2026/CVE-2026-28743.json
index 3e7900fe93..a92c425511 100644
--- a/data/2026/CVE-2026-28743.json
+++ b/data/2026/CVE-2026-28743.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) VTune(TM) Profiler software","vendor":"n/a","versions":[{"status":"affected","version":"before version 2026.0.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-28743","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:40.423","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) VTune(TM) Profiler software","vendor":"n/a","versions":[{"status":"affected","version":"before version 2026.0.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-28743","lastModified":"2026-11-13T15:17:48.980","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28743","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:57.740989Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:40.423","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-28765.json b/data/2026/CVE-2026-28765.json
index c010c902d0..4d4cfeba91 100644
--- a/data/2026/CVE-2026-28765.json
+++ b/data/2026/CVE-2026-28765.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) VTune(TM) Profiler software","vendor":"n/a","versions":[{"status":"affected","version":"before version 2026.0.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-28765","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:40.563","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) VTune(TM) Profiler software","vendor":"n/a","versions":[{"status":"affected","version":"before version 2026.0.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-28765","lastModified":"2026-11-13T15:17:49.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:59.992173Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:40.563","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-32672.json b/data/2026/CVE-2026-32672.json
index 17831993b9..7d722c2824 100644
--- a/data/2026/CVE-2026-32672.json
+++ b/data/2026/CVE-2026-32672.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) NPU Drivers","vendor":"n/a","versions":[{"status":"affected","version":"before version 32.0.100.4778"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-32672","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:40.957","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01521.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) NPU Drivers","vendor":"n/a","versions":[{"status":"affected","version":"before version 32.0.100.4778"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-32672","lastModified":"2026-11-13T15:17:49.207","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:02.783915Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:40.957","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01521.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-33089.json b/data/2026/CVE-2026-33089.json
index 1650b2c20e..9c86d3aff4 100644
--- a/data/2026/CVE-2026-33089.json
+++ b/data/2026/CVE-2026-33089.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) CIP software","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Intel(R) CIP software within Ring 2: Privileged Process may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-33089","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:41.083","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01516.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) CIP software","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Intel(R) CIP software within Ring 2: Privileged Process may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-33089","lastModified":"2026-11-13T15:17:49.317","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33089","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:05.419516Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:41.083","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01516.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-33270.json b/data/2026/CVE-2026-33270.json
index ddce425169..457df6faa5 100644
--- a/data/2026/CVE-2026-33270.json
+++ b/data/2026/CVE-2026-33270.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Graphics Software","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Intel(R) Graphics Software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-33270","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:41.227","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01513.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Graphics Software","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Intel(R) Graphics Software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-33270","lastModified":"2026-11-13T15:17:49.437","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:08.016609Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:41.227","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01513.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-33279.json b/data/2026/CVE-2026-33279.json
index b2010e7700..7f6d76d821 100644
--- a/data/2026/CVE-2026-33279.json
+++ b/data/2026/CVE-2026-33279.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) VTune(TM) Profiler software","vendor":"n/a","versions":[{"status":"affected","version":"before version 2026.0.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-33279","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:41.360","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) VTune(TM) Profiler software","vendor":"n/a","versions":[{"status":"affected","version":"before version 2026.0.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-33279","lastModified":"2026-11-13T15:17:49.557","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33279","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:10.526749Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:41.360","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01477.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-35060.json b/data/2026/CVE-2026-35060.json
index 4802a4a9c4..9e9d4c437e 100644
--- a/data/2026/CVE-2026-35060.json
+++ b/data/2026/CVE-2026-35060.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AI Playground software","vendor":"n/a","versions":[{"status":"affected","version":"before version v3.1.1-beta"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication for critical function for some AI Playground software before version v3.1.1-beta within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-35060","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:42.030","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01518.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AI Playground software","vendor":"n/a","versions":[{"status":"affected","version":"before version v3.1.1-beta"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication for critical function for some AI Playground software before version v3.1.1-beta within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-35060","lastModified":"2026-11-13T15:17:49.670","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35060","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:12.729800Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:42.030","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01518.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-35683.json b/data/2026/CVE-2026-35683.json
index 8496210fdb..ade99bf569 100644
--- a/data/2026/CVE-2026-35683.json
+++ b/data/2026/CVE-2026-35683.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Multi-Buffer Crypto for IPSec","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for some Intel(R) Multi-Buffer Crypto for IPSec within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-35683","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:42.227","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01512.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Multi-Buffer Crypto for IPSec","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for some Intel(R) Multi-Buffer Crypto for IPSec within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-35683","lastModified":"2026-11-13T15:17:49.783","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:14.958636Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:42.227","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01512.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-39456.json b/data/2026/CVE-2026-39456.json
index 453c2500de..905a07b1cd 100644
--- a/data/2026/CVE-2026-39456.json
+++ b/data/2026/CVE-2026-39456.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Media Transcode Accelerator","vendor":"n/a","versions":[{"status":"affected","version":"before version 1.0.0-00128"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Media Transcode Accelerator before version 1.0.0-00128 within Ring 3: User Applications may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-39456","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:42.387","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01510.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Media Transcode Accelerator","vendor":"n/a","versions":[{"status":"affected","version":"before version 1.0.0-00128"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Media Transcode Accelerator before version 1.0.0-00128 within Ring 3: User Applications may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-39456","lastModified":"2026-11-13T15:17:49.890","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:17.237296Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:42.387","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01510.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-40065.json b/data/2026/CVE-2026-40065.json
index 5216b825f9..98c2dab362 100644
--- a/data/2026/CVE-2026-40065.json
+++ b/data/2026/CVE-2026-40065.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version v3.7"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40065","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:42.513","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version v3.7"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40065","lastModified":"2026-11-13T15:17:50.003","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40065","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:26:54.894798Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:42.513","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-49341.json b/data/2026/CVE-2026-49341.json
new file mode 100644
index 0000000000..f7baffdf29
--- /dev/null
+++ b/data/2026/CVE-2026-49341.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, there is a remotely reachable denial-of-service vulnerability in bacnet-stack affecting the default demo server built from the unmodified apps/server/main.c. This issue has been patched in version 1.5.1."}],"id":"CVE-2026-49341","lastModified":"2026-11-13T16:19:01.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:01.817","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1347"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7r8r-2rj2-5wvr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-674"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-49990.json b/data/2026/CVE-2026-49990.json
new file mode 100644
index 0000000000..847b5ad613
--- /dev/null
+++ b/data/2026/CVE-2026-49990.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":">= 1.4.2, < 1.4.5"},{"status":"affected","version":">= 1.5.0, < 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1."}],"id":"CVE-2026-49990","lastModified":"2026-11-13T16:19:01.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:01.983","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1362"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-52787.json b/data/2026/CVE-2026-52787.json
new file mode 100644
index 0000000000..f6fd4aa178
--- /dev/null
+++ b/data/2026/CVE-2026-52787.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0-rc2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2."}],"id":"CVE-2026-52787","lastModified":"2026-11-13T16:19:02.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:02.137","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1363"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4fgg-fghm-jm43"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-131"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-52788.json b/data/2026/CVE-2026-52788.json
new file mode 100644
index 0000000000..77ec8634f4
--- /dev/null
+++ b/data/2026/CVE-2026-52788.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the bsc_node_parse_urls() function in src/bacnet/datalink/bsc/bsc-node.c contains three distinct bugs when parsing space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Two bugs cause out-of-bounds writes past the utf8_urls[10][129] array in the static BSC_ADDRESS_RESOLUTION structure. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-52788","lastModified":"2026-11-13T16:19:02.297","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:02.297","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1365"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rf83-3rr5-v4mj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-52789.json b/data/2026/CVE-2026-52789.json
new file mode 100644
index 0000000000..11b43c6811
--- /dev/null
+++ b/data/2026/CVE-2026-52789.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handler_read_property_multiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-52789","lastModified":"2026-11-13T16:19:02.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:02.440","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1374"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4rf9-4vgq-5gcw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-52790.json b/data/2026/CVE-2026-52790.json
new file mode 100644
index 0000000000..175968b279
--- /dev/null
+++ b/data/2026/CVE-2026-52790.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-52790","lastModified":"2026-11-13T16:19:02.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:02.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1375"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-562"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-55311.json b/data/2026/CVE-2026-55311.json
index 7010ed241f..87e2458c00 100644
--- a/data/2026/CVE-2026-55311.json
+++ b/data/2026/CVE-2026-55311.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55311","lastModified":"2026-11-13T05:18:40.197","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:12.897","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55311","lastModified":"2026-11-13T15:17:50.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:36.390388Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:12.897","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-55316.json b/data/2026/CVE-2026-55316.json
index 0a20f55fdd..fc85ad6ae5 100644
--- a/data/2026/CVE-2026-55316.json
+++ b/data/2026/CVE-2026-55316.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55316","lastModified":"2026-11-10T21:46:32.097","metrics":{},"published":"2026-11-10T20:19:13.107","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55316","lastModified":"2026-11-13T16:19:02.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:27:07.453572Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.107","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-55319.json b/data/2026/CVE-2026-55319.json
index 9354a7fd4c..8aa7da5732 100644
--- a/data/2026/CVE-2026-55319.json
+++ b/data/2026/CVE-2026-55319.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55319","lastModified":"2026-11-13T05:18:40.483","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55319","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.220","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55319","lastModified":"2026-11-13T15:17:50.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55319","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:17.659604Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.220","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-55335.json b/data/2026/CVE-2026-55335.json
index 23a1a49430..ddd8ac1051 100644
--- a/data/2026/CVE-2026-55335.json
+++ b/data/2026/CVE-2026-55335.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55335","lastModified":"2026-11-10T21:46:38.327","metrics":{},"published":"2026-11-10T20:19:13.430","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55335","lastModified":"2026-11-13T16:19:03.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55335","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:44:48.151839Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.430","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-55348.json b/data/2026/CVE-2026-55348.json
index be5c5389ce..d8ef5b7fcf 100644
--- a/data/2026/CVE-2026-55348.json
+++ b/data/2026/CVE-2026-55348.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a negative buffer size due to an improper or implicit cast. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55348","lastModified":"2026-11-10T21:46:38.430","metrics":{},"published":"2026-11-10T20:19:13.740","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a negative buffer size due to an improper or implicit cast. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55348","lastModified":"2026-11-13T16:19:04.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55348","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:28:53.773587Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.740","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-704"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-55360.json b/data/2026/CVE-2026-55360.json
index 558ea662f9..19cbab9812 100644
--- a/data/2026/CVE-2026-55360.json
+++ b/data/2026/CVE-2026-55360.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel encryption due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55360","lastModified":"2026-11-13T05:18:40.923","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55360","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.857","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel encryption due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55360","lastModified":"2026-11-13T15:17:50.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55360","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:26.804692Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.857","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-55362.json b/data/2026/CVE-2026-55362.json
index 93c07c245b..954d422d48 100644
--- a/data/2026/CVE-2026-55362.json
+++ b/data/2026/CVE-2026-55362.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55362","lastModified":"2026-11-13T05:18:41.040","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55362","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.970","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55362","lastModified":"2026-11-13T15:17:50.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55362","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:36.292588Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.970","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56897.json b/data/2026/CVE-2026-56897.json
index 75aa314e87..f6b5b00a53 100644
--- a/data/2026/CVE-2026-56897.json
+++ b/data/2026/CVE-2026-56897.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56897","lastModified":"2026-11-10T21:46:32.150","metrics":{},"published":"2026-11-10T20:19:14.443","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56897","lastModified":"2026-11-13T16:19:05.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56897","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:49.230096Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:14.443","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56898.json b/data/2026/CVE-2026-56898.json
index cca2ee65d5..9cb13ffbc3 100644
--- a/data/2026/CVE-2026-56898.json
+++ b/data/2026/CVE-2026-56898.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56898","lastModified":"2026-11-13T05:18:41.580","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56898","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:14.570","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56898","lastModified":"2026-11-13T15:17:50.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56898","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:27.896571Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:14.570","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56902.json b/data/2026/CVE-2026-56902.json
index ae7a2d5770..aaac61c32b 100644
--- a/data/2026/CVE-2026-56902.json
+++ b/data/2026/CVE-2026-56902.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56902","lastModified":"2026-11-10T21:46:38.490","metrics":{},"published":"2026-11-10T20:19:14.680","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56902","lastModified":"2026-11-13T16:19:06.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56902","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:40:20.479330Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:14.680","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56909.json b/data/2026/CVE-2026-56909.json
index 86b68ad11e..69cfcde87f 100644
--- a/data/2026/CVE-2026-56909.json
+++ b/data/2026/CVE-2026-56909.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56909","lastModified":"2026-11-13T05:18:41.703","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56909","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:14.800","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56909","lastModified":"2026-11-13T15:17:50.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56909","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:29.010725Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:14.800","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56912.json b/data/2026/CVE-2026-56912.json
index 54ee048561..6c5b8829f2 100644
--- a/data/2026/CVE-2026-56912.json
+++ b/data/2026/CVE-2026-56912.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ac_remove_smmu_prot_internal of acfw_smmu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56912","lastModified":"2026-11-13T05:18:42.000","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56912","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.130","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ac_remove_smmu_prot_internal of acfw_smmu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56912","lastModified":"2026-11-13T15:17:51.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56912","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:22.208422Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.130","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56916.json b/data/2026/CVE-2026-56916.json
index 8878e5e5ef..c896a67003 100644
--- a/data/2026/CVE-2026-56916.json
+++ b/data/2026/CVE-2026-56916.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56916","lastModified":"2026-11-10T21:46:32.173","metrics":{},"published":"2026-11-10T20:19:15.233","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56916","lastModified":"2026-11-13T15:17:51.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:53:32.195635Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.233","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56919.json b/data/2026/CVE-2026-56919.json
index bce701eaa6..f9487476fb 100644
--- a/data/2026/CVE-2026-56919.json
+++ b/data/2026/CVE-2026-56919.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In PackageSignatureChecker of SystemUIGoogleModule.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation."}],"id":"CVE-2026-56919","lastModified":"2026-11-13T05:18:42.120","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56919","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.353","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In PackageSignatureChecker of SystemUIGoogleModule.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation."}],"id":"CVE-2026-56919","lastModified":"2026-11-13T15:17:51.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56919","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:08.543258Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.353","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56929.json b/data/2026/CVE-2026-56929.json
index 6fce9a0860..3ad8c3b600 100644
--- a/data/2026/CVE-2026-56929.json
+++ b/data/2026/CVE-2026-56929.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56929","lastModified":"2026-11-13T05:18:42.350","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56929","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.577","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56929","lastModified":"2026-11-13T15:17:51.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56929","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:10.791921Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.577","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56934.json b/data/2026/CVE-2026-56934.json
index a5d2960172..60ee95912d 100644
--- a/data/2026/CVE-2026-56934.json
+++ b/data/2026/CVE-2026-56934.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56934","lastModified":"2026-11-13T05:18:42.880","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56934","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.977","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56934","lastModified":"2026-11-13T15:17:51.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56934","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:14.236051Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.977","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56935.json b/data/2026/CVE-2026-56935.json
index d8f568ea70..ba368197c4 100644
--- a/data/2026/CVE-2026-56935.json
+++ b/data/2026/CVE-2026-56935.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56935","lastModified":"2026-11-10T21:46:34.083","metrics":{},"published":"2026-11-10T20:19:16.087","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56935","lastModified":"2026-11-13T16:19:08.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56935","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:40:53.635934Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.087","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56943.json b/data/2026/CVE-2026-56943.json
index 6c65fe4234..8b04d3494d 100644
--- a/data/2026/CVE-2026-56943.json
+++ b/data/2026/CVE-2026-56943.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56943","lastModified":"2026-11-10T21:46:32.213","metrics":{},"published":"2026-11-10T20:19:16.300","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56943","lastModified":"2026-11-13T16:19:09.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56943","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:41:41.522744Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.300","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56947.json b/data/2026/CVE-2026-56947.json
index 944de08bbc..3695734da3 100644
--- a/data/2026/CVE-2026-56947.json
+++ b/data/2026/CVE-2026-56947.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56947","lastModified":"2026-11-10T21:46:38.703","metrics":{},"published":"2026-11-10T20:19:16.650","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56947","lastModified":"2026-11-13T16:19:10.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56947","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:42:15.530544Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.650","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56956.json b/data/2026/CVE-2026-56956.json
index a89270c8d6..0fb2a7a71f 100644
--- a/data/2026/CVE-2026-56956.json
+++ b/data/2026/CVE-2026-56956.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56956","lastModified":"2026-11-10T21:46:32.223","metrics":{},"published":"2026-11-10T20:19:17.003","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56956","lastModified":"2026-11-13T16:19:11.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56956","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:42:34.536785Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.003","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56971.json b/data/2026/CVE-2026-56971.json
index 575c5beb52..7e03d3083b 100644
--- a/data/2026/CVE-2026-56971.json
+++ b/data/2026/CVE-2026-56971.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56971","lastModified":"2026-11-13T05:18:43.800","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56971","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.330","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56971","lastModified":"2026-11-13T15:17:51.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56971","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:49.168374Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.330","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57004.json b/data/2026/CVE-2026-57004.json
index f6c404c50c..8aa5813218 100644
--- a/data/2026/CVE-2026-57004.json
+++ b/data/2026/CVE-2026-57004.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-57004","lastModified":"2026-11-13T05:18:44.273","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57004","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.643","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-57004","lastModified":"2026-11-13T15:17:51.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57004","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:16.505723Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.643","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57009.json b/data/2026/CVE-2026-57009.json
index e46ec6139b..9689cff05d 100644
--- a/data/2026/CVE-2026-57009.json
+++ b/data/2026/CVE-2026-57009.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-57009","lastModified":"2026-11-13T05:18:44.513","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57009","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.860","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-57009","lastModified":"2026-11-13T15:17:52.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57009","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:18.861881Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.860","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57036.json b/data/2026/CVE-2026-57036.json
index 139d9642b9..f9b913aa63 100644
--- a/data/2026/CVE-2026-57036.json
+++ b/data/2026/CVE-2026-57036.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In send_vdu_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-57036","lastModified":"2026-11-13T05:18:44.737","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:18.153","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In send_vdu_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-57036","lastModified":"2026-11-13T15:17:52.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:43.289301Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:18.153","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57047.json b/data/2026/CVE-2026-57047.json
index 47767f5dd7..555bb1acc5 100644
--- a/data/2026/CVE-2026-57047.json
+++ b/data/2026/CVE-2026-57047.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-57047","lastModified":"2026-11-13T05:18:45.177","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57047","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:18.473","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-57047","lastModified":"2026-11-13T15:17:52.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57047","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:21.124818Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:18.473","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58265.json b/data/2026/CVE-2026-58265.json
new file mode 100644
index 0000000000..97c88d0e4f
--- /dev/null
+++ b/data/2026/CVE-2026-58265.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-58265","lastModified":"2026-11-13T16:19:12.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:12.393","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1396"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-j66x-fr38-r7m5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-58498.json b/data/2026/CVE-2026-58498.json
new file mode 100644
index 0000000000..469a26f9ff
--- /dev/null
+++ b/data/2026/CVE-2026-58498.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-of-bounds write to the global transmit buffer under ASan. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-58498","lastModified":"2026-11-13T16:19:12.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:12.557","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1392"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4p4w-m434-jrhj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-58681.json b/data/2026/CVE-2026-58681.json
index 7a95510735..7a96a5ffcb 100644
--- a/data/2026/CVE-2026-58681.json
+++ b/data/2026/CVE-2026-58681.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58681","lastModified":"2026-11-13T05:18:46.117","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58681","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.163","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58681","lastModified":"2026-11-13T15:17:52.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58681","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:23.463896Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.163","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58684.json b/data/2026/CVE-2026-58684.json
index b22466fdb3..d2d300c7c7 100644
--- a/data/2026/CVE-2026-58684.json
+++ b/data/2026/CVE-2026-58684.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58684","lastModified":"2026-11-13T05:18:46.253","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.290","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58684","lastModified":"2026-11-13T15:17:52.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:45.494473Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.290","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58702.json b/data/2026/CVE-2026-58702.json
index d1bd231ce1..8732b1872f 100644
--- a/data/2026/CVE-2026-58702.json
+++ b/data/2026/CVE-2026-58702.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58702","lastModified":"2026-11-10T21:46:38.917","metrics":{},"published":"2026-11-10T20:19:23.793","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58702","lastModified":"2026-11-13T16:19:12.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58702","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:43:31.558368Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.793","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58722.json b/data/2026/CVE-2026-58722.json
index 4968c11014..a7018e9eb1 100644
--- a/data/2026/CVE-2026-58722.json
+++ b/data/2026/CVE-2026-58722.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58722","lastModified":"2026-11-13T05:18:47.047","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58722","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.040","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58722","lastModified":"2026-11-13T15:17:52.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58722","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:22.242244Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.040","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58752.json b/data/2026/CVE-2026-58752.json
index 3da35da732..13d06d93d3 100644
--- a/data/2026/CVE-2026-58752.json
+++ b/data/2026/CVE-2026-58752.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In aoc_unlocked_ioctl_handle_ion_fd of aoc.c, there is a possible type confusion due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58752","lastModified":"2026-11-10T21:46:32.387","metrics":{},"published":"2026-11-10T20:19:24.567","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In aoc_unlocked_ioctl_handle_ion_fd of aoc.c, there is a possible type confusion due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58752","lastModified":"2026-11-13T15:17:52.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58752","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:59:20.562679Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.567","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58762.json b/data/2026/CVE-2026-58762.json
index 7bc7c4d697..6a4f08e00e 100644
--- a/data/2026/CVE-2026-58762.json
+++ b/data/2026/CVE-2026-58762.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ac_get_prot_config of plat_trusty.c, there is a possible memory corruption due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58762","lastModified":"2026-11-10T21:46:38.980","metrics":{},"published":"2026-11-10T20:19:24.907","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ac_get_prot_config of plat_trusty.c, there is a possible memory corruption due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58762","lastModified":"2026-11-13T16:19:14.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:23:20.813262Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.907","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58769.json b/data/2026/CVE-2026-58769.json
index 807a69de77..41ff1516e7 100644
--- a/data/2026/CVE-2026-58769.json
+++ b/data/2026/CVE-2026-58769.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58769","lastModified":"2026-11-10T21:46:38.997","metrics":{},"published":"2026-11-10T20:19:25.030","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58769","lastModified":"2026-11-13T16:19:15.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:22:51.035260Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:25.030","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58782.json b/data/2026/CVE-2026-58782.json
index 728edd758a..7395863eb2 100644
--- a/data/2026/CVE-2026-58782.json
+++ b/data/2026/CVE-2026-58782.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58782","lastModified":"2026-11-10T21:46:32.437","metrics":{},"published":"2026-11-10T20:19:25.597","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58782","lastModified":"2026-11-13T16:19:16.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58782","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:44:13.129854Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:25.597","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58783.json b/data/2026/CVE-2026-58783.json
index b5188899b2..b4870d2336 100644
--- a/data/2026/CVE-2026-58783.json
+++ b/data/2026/CVE-2026-58783.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58783","lastModified":"2026-11-10T21:46:32.447","metrics":{},"published":"2026-11-10T20:19:25.693","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58783","lastModified":"2026-11-13T16:19:17.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58783","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:22:21.468411Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:25.693","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58796.json b/data/2026/CVE-2026-58796.json
index 93e349b494..043e098945 100644
--- a/data/2026/CVE-2026-58796.json
+++ b/data/2026/CVE-2026-58796.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58796","lastModified":"2026-11-13T05:18:48.650","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58796","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.633","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58796","lastModified":"2026-11-13T15:17:53.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58796","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:10.730260Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.633","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58797.json b/data/2026/CVE-2026-58797.json
index 030c6f4d48..657d465407 100644
--- a/data/2026/CVE-2026-58797.json
+++ b/data/2026/CVE-2026-58797.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In register_dump_dpa of sswrp_pcie.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58797","lastModified":"2026-11-10T21:46:39.180","metrics":{},"published":"2026-11-10T20:19:26.750","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In register_dump_dpa of sswrp_pcie.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58797","lastModified":"2026-11-13T16:19:19.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:21:50.237941Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.750","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58799.json b/data/2026/CVE-2026-58799.json
index 57ca3e21e3..207e0b256e 100644
--- a/data/2026/CVE-2026-58799.json
+++ b/data/2026/CVE-2026-58799.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of rmmi_utility.c, there is a possible way to trigger an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58799","lastModified":"2026-11-13T05:18:48.887","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58799","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.950","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of rmmi_utility.c, there is a possible way to trigger an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58799","lastModified":"2026-11-13T15:17:53.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58799","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:24.562212Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.950","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58801.json b/data/2026/CVE-2026-58801.json
index d213450614..e97d444aec 100644
--- a/data/2026/CVE-2026-58801.json
+++ b/data/2026/CVE-2026-58801.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassigned stream identifiers due to a logic error. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58801","lastModified":"2026-11-10T21:46:34.133","metrics":{},"published":"2026-11-10T20:19:27.163","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassigned stream identifiers due to a logic error. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58801","lastModified":"2026-11-13T16:19:20.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58801","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:20:58.908614Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.163","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58803.json b/data/2026/CVE-2026-58803.json
index 6323388849..1d7ae8661f 100644
--- a/data/2026/CVE-2026-58803.json
+++ b/data/2026/CVE-2026-58803.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58803","lastModified":"2026-11-10T21:46:32.503","metrics":{},"published":"2026-11-10T20:19:27.267","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58803","lastModified":"2026-11-13T16:19:21.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:20:17.619025Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.267","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-203"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58806.json b/data/2026/CVE-2026-58806.json
index 8f366d1aac..28659a3b0e 100644
--- a/data/2026/CVE-2026-58806.json
+++ b/data/2026/CVE-2026-58806.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In get_sswrp_state of cpm_mbox_srv/main.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58806","lastModified":"2026-11-10T21:46:39.377","metrics":{},"published":"2026-11-10T20:19:27.610","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In get_sswrp_state of cpm_mbox_srv/main.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58806","lastModified":"2026-11-13T16:19:22.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:19:22.552996Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.610","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58808.json b/data/2026/CVE-2026-58808.json
index 91e95bd22d..0ae8d010cd 100644
--- a/data/2026/CVE-2026-58808.json
+++ b/data/2026/CVE-2026-58808.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58808","lastModified":"2026-11-10T21:46:39.470","metrics":{},"published":"2026-11-10T20:19:27.830","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58808","lastModified":"2026-11-13T16:19:23.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58808","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:18:47.302212Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.830","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58810.json b/data/2026/CVE-2026-58810.json
index 23dc72898f..9a618b4338 100644
--- a/data/2026/CVE-2026-58810.json
+++ b/data/2026/CVE-2026-58810.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to non-secure callers due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58810","lastModified":"2026-11-10T21:46:36.880","metrics":{},"published":"2026-11-10T20:19:28.037","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to non-secure callers due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58810","lastModified":"2026-11-13T15:17:53.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58810","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:02:48.017926Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.037","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-457"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58811.json b/data/2026/CVE-2026-58811.json
index 2f5f33c3f4..d7ff866972 100644
--- a/data/2026/CVE-2026-58811.json
+++ b/data/2026/CVE-2026-58811.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_get_mair_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access mappings due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58811","lastModified":"2026-11-10T21:46:32.543","metrics":{},"published":"2026-11-10T20:19:28.147","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_get_mair_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access mappings due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58811","lastModified":"2026-11-13T16:19:24.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58811","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:17:47.014831Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.147","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58812.json b/data/2026/CVE-2026-58812.json
index ef0682dac5..002aecfb82 100644
--- a/data/2026/CVE-2026-58812.json
+++ b/data/2026/CVE-2026-58812.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In decode of fw_vp9_dec_pic.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58812","lastModified":"2026-11-10T21:46:32.553","metrics":{},"published":"2026-11-10T20:19:28.243","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In decode of fw_vp9_dec_pic.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58812","lastModified":"2026-11-13T16:19:25.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:17:16.394810Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.243","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59074.json b/data/2026/CVE-2026-59074.json
index 02c1f031e7..dce4c9df99 100644
--- a/data/2026/CVE-2026-59074.json
+++ b/data/2026/CVE-2026-59074.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​  obtain​ ​a ​​valid,​​ fully-signed​​ session ​​token​​ for​​ any ​​account ​​in​ ​the​ ​system. This allows the attacker to impersonate any user, including administrators.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59074","lastModified":"2026-11-13T08:17:17.347","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.347","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"cvd@cert.pl","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​  obtain​ ​a ​​valid,​​ fully-signed​​ session ​​token​​ for​​ any ​​account ​​in​ ​the​ ​system. This allows the attacker to impersonate any user, including administrators.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59074","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.347","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"cvd@cert.pl","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-59075.json b/data/2026/CVE-2026-59075.json
index b0a30deb77..31b7c5910d 100644
--- a/data/2026/CVE-2026-59075.json
+++ b/data/2026/CVE-2026-59075.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data.\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59075","lastModified":"2026-11-13T08:17:17.517","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.517","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-917"}],"source":"cvd@cert.pl","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data.\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59075","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.517","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-917"}],"source":"cvd@cert.pl","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-59076.json b/data/2026/CVE-2026-59076.json
index 2bbf6d2bf5..e5b763cf48 100644
--- a/data/2026/CVE-2026-59076.json
+++ b/data/2026/CVE-2026-59076.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser.\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59076","lastModified":"2026-11-13T08:17:17.653","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.653","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser.\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59076","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.653","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-59077.json b/data/2026/CVE-2026-59077.json
index 9b147c92c7..20e970d44e 100644
--- a/data/2026/CVE-2026-59077.json
+++ b/data/2026/CVE-2026-59077.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59077","lastModified":"2026-11-13T08:17:17.793","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.793","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59077","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.793","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-59078.json b/data/2026/CVE-2026-59078.json
index c43011e774..801a3f0bde 100644
--- a/data/2026/CVE-2026-59078.json
+++ b/data/2026/CVE-2026-59078.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar.\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59078","lastModified":"2026-11-13T08:17:17.933","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.933","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar.\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59078","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:17.933","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-59079.json b/data/2026/CVE-2026-59079.json
index 390712edbc..5bb201199f 100644
--- a/data/2026/CVE-2026-59079.json
+++ b/data/2026/CVE-2026-59079.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59079","lastModified":"2026-11-13T08:17:18.067","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:18.067","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"cvd@cert.pl","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59079","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:18.067","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59074"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"cvd@cert.pl","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-59080.json b/data/2026/CVE-2026-59080.json
index 017338db16..e12afa40f4 100644
--- a/data/2026/CVE-2026-59080.json
+++ b/data/2026/CVE-2026-59080.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThanOrEqual":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used.\n\n\n\nThe vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary."}],"id":"CVE-2026-59080","lastModified":"2026-11-13T08:17:18.210","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:18.210","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59081"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-598"}],"source":"cvd@cert.pl","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThanOrEqual":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used.\n\n\n\nThe vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary."}],"id":"CVE-2026-59080","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:18.210","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-59081"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-598"}],"source":"cvd@cert.pl","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-59081.json b/data/2026/CVE-2026-59081.json
index b1dcaef827..ff1381753e 100644
--- a/data/2026/CVE-2026-59081.json
+++ b/data/2026/CVE-2026-59081.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.\n\n\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59081","lastModified":"2026-11-13T08:17:18.353","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:18.353","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/07/CVE-2026-59081"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"cvd@cert.pl","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Edito CMS","vendor":"Edito","versions":[{"lessThan":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.\n\n\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released."}],"id":"CVE-2026-59081","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}]},"published":"2026-11-13T08:17:18.353","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/07/CVE-2026-59081"},{"source":"cvd@cert.pl","url":"https://www.edito.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"cvd@cert.pl","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-59082.json b/data/2026/CVE-2026-59082.json
index a219713c94..c4dd3a21b7 100644
--- a/data/2026/CVE-2026-59082.json
+++ b/data/2026/CVE-2026-59082.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC WinCC V7.5","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC WinCC V8.0","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC WinCC V8.1","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected devices implicitly execute active content when opening files. This could allow an attacker to make the user execute arbitrary code on the device."}],"id":"CVE-2026-59082","lastModified":"2026-11-12T21:35:47.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:20.510","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-979641.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-357"}],"source":"productcert@siemens.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC WinCC V7.5","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC WinCC V8.0","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC WinCC V8.1","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected devices implicitly execute active content when opening files. This could allow an attacker to make the user execute arbitrary code on the device."}],"id":"CVE-2026-59082","lastModified":"2026-11-13T15:17:53.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59082","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:08:17.448657Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:20.510","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-979641.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-357"}],"source":"productcert@siemens.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59574.json b/data/2026/CVE-2026-59574.json
index bc357a331e..c72351cb4e 100644
--- a/data/2026/CVE-2026-59574.json
+++ b/data/2026/CVE-2026-59574.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds read and write when formatting firmware log notifications due to an incorrect bounds check. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59574","lastModified":"2026-11-10T21:46:42.817","metrics":{},"published":"2026-11-10T20:19:28.770","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds read and write when formatting firmware log notifications due to an incorrect bounds check. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59574","lastModified":"2026-11-13T15:17:53.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":2.4,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:02:10.748445Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.770","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59575.json b/data/2026/CVE-2026-59575.json
index 444e038baf..44704a4f49 100644
--- a/data/2026/CVE-2026-59575.json
+++ b/data/2026/CVE-2026-59575.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In stpropnci_cb_observe_mode_suspend of stpropnci_prop_android.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59575","lastModified":"2026-11-10T21:46:39.573","metrics":{},"published":"2026-11-10T20:19:28.870","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In stpropnci_cb_observe_mode_suspend of stpropnci_prop_android.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59575","lastModified":"2026-11-13T15:17:53.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:58:46.819733Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.870","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59579.json b/data/2026/CVE-2026-59579.json
index ef00a7ba61..4d91f64b09 100644
--- a/data/2026/CVE-2026-59579.json
+++ b/data/2026/CVE-2026-59579.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation."}],"id":"CVE-2026-59579","lastModified":"2026-11-10T21:46:34.160","metrics":{},"published":"2026-11-10T20:19:29.073","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation."}],"id":"CVE-2026-59579","lastModified":"2026-11-13T15:17:53.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:01:24.286720Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:29.073","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59580.json b/data/2026/CVE-2026-59580.json
index 05233be4a5..0e6df36f1e 100644
--- a/data/2026/CVE-2026-59580.json
+++ b/data/2026/CVE-2026-59580.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In trusty_context_switch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59580","lastModified":"2026-11-10T21:46:32.570","metrics":{},"published":"2026-11-10T20:19:29.170","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In trusty_context_switch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59580","lastModified":"2026-11-13T15:17:54.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:00:56.150594Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:29.170","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59583.json b/data/2026/CVE-2026-59583.json
index 1729b8b49e..fe2fb096fb 100644
--- a/data/2026/CVE-2026-59583.json
+++ b/data/2026/CVE-2026-59583.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via a scheme downgrade due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59583","lastModified":"2026-11-10T21:46:34.203","metrics":{},"published":"2026-11-10T20:19:29.360","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via a scheme downgrade due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59583","lastModified":"2026-11-13T16:19:26.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:16:38.470035Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:29.360","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59586.json b/data/2026/CVE-2026-59586.json
index 116f46f5aa..578c0d0159 100644
--- a/data/2026/CVE-2026-59586.json
+++ b/data/2026/CVE-2026-59586.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59586","lastModified":"2026-11-10T21:46:39.833","metrics":{},"published":"2026-11-10T20:19:29.570","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59586","lastModified":"2026-11-13T15:17:54.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:00:22.012049Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:29.570","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-325"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59597.json b/data/2026/CVE-2026-59597.json
index 3aee82f1bd..c44dfca8bc 100644
--- a/data/2026/CVE-2026-59597.json
+++ b/data/2026/CVE-2026-59597.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In bindDataService of DataServiceManager.java, there is a possible way to retain privileged tunnel management permissions across configuration updates due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59597","lastModified":"2026-11-13T05:18:50.587","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59597","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.343","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In bindDataService of DataServiceManager.java, there is a possible way to retain privileged tunnel management permissions across configuration updates due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59597","lastModified":"2026-11-13T15:17:54.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59597","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:13.043597Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.343","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59601.json b/data/2026/CVE-2026-59601.json
index c211e6ea6d..ef29709689 100644
--- a/data/2026/CVE-2026-59601.json
+++ b/data/2026/CVE-2026-59601.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In CalculateSampleRate of cldma_alcedo.cc, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59601","lastModified":"2026-11-10T21:46:40.007","metrics":{},"published":"2026-11-10T20:19:30.660","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In CalculateSampleRate of cldma_alcedo.cc, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59601","lastModified":"2026-11-13T16:19:27.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59601","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:16:07.344635Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.660","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59604.json b/data/2026/CVE-2026-59604.json
index a9a682c75a..fa940d7eac 100644
--- a/data/2026/CVE-2026-59604.json
+++ b/data/2026/CVE-2026-59604.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59604","lastModified":"2026-11-10T21:46:36.950","metrics":{},"published":"2026-11-10T20:19:30.863","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59604","lastModified":"2026-11-13T15:17:54.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:58:16.084393Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.863","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59606.json b/data/2026/CVE-2026-59606.json
index 84d4d2ccf3..c49594b3fc 100644
--- a/data/2026/CVE-2026-59606.json
+++ b/data/2026/CVE-2026-59606.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify global reset registers from non-secure software due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59606","lastModified":"2026-11-13T05:18:50.807","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59606","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.963","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify global reset registers from non-secure software due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59606","lastModified":"2026-11-13T15:17:54.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59606","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:32.678698Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.963","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59607.json b/data/2026/CVE-2026-59607.json
index e561c24e96..877f1af122 100644
--- a/data/2026/CVE-2026-59607.json
+++ b/data/2026/CVE-2026-59607.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In TzPipelineInputExtractor of TzPipelineInputExtractor.cpp, there is a possible Logic check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59607","lastModified":"2026-11-13T05:18:50.920","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59607","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.073","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In TzPipelineInputExtractor of TzPipelineInputExtractor.cpp, there is a possible Logic check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59607","lastModified":"2026-11-13T15:17:54.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59607","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:43.905180Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.073","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59614.json b/data/2026/CVE-2026-59614.json
index 40d1042c2f..2f0234ce92 100644
--- a/data/2026/CVE-2026-59614.json
+++ b/data/2026/CVE-2026-59614.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of oem_svc_setup.c, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59614","lastModified":"2026-11-10T21:46:32.697","metrics":{},"published":"2026-11-10T20:19:31.707","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of oem_svc_setup.c, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59614","lastModified":"2026-11-13T15:17:55.010","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59614","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:56:51.906810Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.707","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
diff --git a/data/2026/CVE-2026-59618.json b/data/2026/CVE-2026-59618.json
index 2daa97e01e..37d01b5614 100644
--- a/data/2026/CVE-2026-59618.json
+++ b/data/2026/CVE-2026-59618.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent shared memory buffers due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59618","lastModified":"2026-11-10T21:46:32.710","metrics":{},"published":"2026-11-10T20:19:31.930","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent shared memory buffers due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59618","lastModified":"2026-11-13T15:17:55.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:54:19.432885Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.930","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-60035.json b/data/2026/CVE-2026-60035.json
index 377ca207af..5d7b03c7f1 100644
--- a/data/2026/CVE-2026-60035.json
+++ b/data/2026/CVE-2026-60035.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60035","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:22.783","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60035","lastModified":"2026-11-13T15:17:55.257","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60035","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:00:57.434582Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:22.783","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-60040.json b/data/2026/CVE-2026-60040.json
index a901b7cd6a..61eabb84d2 100644
--- a/data/2026/CVE-2026-60040.json
+++ b/data/2026/CVE-2026-60040.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability."}],"id":"CVE-2026-60040","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:23.610","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"info@cert.vde.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability."}],"id":"CVE-2026-60040","lastModified":"2026-11-13T15:17:55.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60040","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:03:25.333211Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.610","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"info@cert.vde.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-60045.json b/data/2026/CVE-2026-60045.json
index 4ac8921a24..292e2ba97a 100644
--- a/data/2026/CVE-2026-60045.json
+++ b/data/2026/CVE-2026-60045.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities."}],"id":"CVE-2026-60045","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:24.470","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"info@cert.vde.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities."}],"id":"CVE-2026-60045","lastModified":"2026-11-13T15:17:55.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60045","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:04:05.878203Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:24.470","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"info@cert.vde.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-61417.json b/data/2026/CVE-2026-61417.json
index 33a11e4e3d..90825f4b5b 100644
--- a/data/2026/CVE-2026-61417.json
+++ b/data/2026/CVE-2026-61417.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SmartFabric OS10 Software","vendor":"Dell","versions":[{"lessThan":"10.6.0.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service."}],"id":"CVE-2026-61417","lastModified":"2026-11-13T10:18:15.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.747","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SmartFabric OS10 Software","vendor":"Dell","versions":[{"lessThan":"10.6.0.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service."}],"id":"CVE-2026-61417","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.747","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-61418.json b/data/2026/CVE-2026-61418.json
index a509497a42..82fcd2e064 100644
--- a/data/2026/CVE-2026-61418.json
+++ b/data/2026/CVE-2026-61418.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SmartFabric OS10 Software","vendor":"Dell","versions":[{"lessThan":"10.6.0.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution."}],"id":"CVE-2026-61418","lastModified":"2026-11-13T10:18:15.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.880","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SmartFabric OS10 Software","vendor":"Dell","versions":[{"lessThan":"10.6.0.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution."}],"id":"CVE-2026-61418","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.880","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-62972.json b/data/2026/CVE-2026-62972.json
new file mode 100644
index 0000000000..d6c2be7354
--- /dev/null
+++ b/data/2026/CVE-2026-62972.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-62972","lastModified":"2026-11-13T16:19:28.813","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:28.813","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1412"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-62973.json b/data/2026/CVE-2026-62973.json
new file mode 100644
index 0000000000..8839956777
--- /dev/null
+++ b/data/2026/CVE-2026-62973.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-62973","lastModified":"2026-11-13T16:19:28.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:28.960","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1395"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-62974.json b/data/2026/CVE-2026-62974.json
new file mode 100644
index 0000000000..096a3873f1
--- /dev/null
+++ b/data/2026/CVE-2026-62974.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-62974","lastModified":"2026-11-13T16:19:29.110","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T16:19:29.110","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1410"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2c8x-f46r-8phh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-63010.json b/data/2026/CVE-2026-63010.json
index 5b82bedf64..ae4a55b420 100644
--- a/data/2026/CVE-2026-63010.json
+++ b/data/2026/CVE-2026-63010.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"groupoffice","vendor":"Intermesh","versions":[{"status":"affected","version":"< 6.8.172"},{"status":"affected","version":"< 25.0.108"},{"status":"affected","version":"< 26.0.33"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33."}],"id":"CVE-2026-63010","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T17:17:45.800","references":[{"source":"security-advisories@github.com","url":"https://github.com/Intermesh/groupoffice/releases/tag/v25.0.108"},{"source":"security-advisories@github.com","url":"https://github.com/Intermesh/groupoffice/releases/tag/v26.0.33"},{"source":"security-advisories@github.com","url":"https://github.com/Intermesh/groupoffice/releases/tag/v6.8.172"},{"source":"security-advisories@github.com","url":"https://github.com/Intermesh/groupoffice/security/advisories/GHSA-jw34-6g49-r6cw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-80"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"groupoffice","vendor":"Intermesh","versions":[{"status":"affected","version":"< 6.8.172"},{"status":"affected","version":"< 25.0.108"},{"status":"affected","version":"< 26.0.33"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33."}],"id":"CVE-2026-63010","lastModified":"2026-11-13T16:19:29.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63010","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:23:43.663019Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:45.800","references":[{"source":"security-advisories@github.com","url":"https://github.com/Intermesh/groupoffice/releases/tag/v25.0.108"},{"source":"security-advisories@github.com","url":"https://github.com/Intermesh/groupoffice/releases/tag/v26.0.33"},{"source":"security-advisories@github.com","url":"https://github.com/Intermesh/groupoffice/releases/tag/v6.8.172"},{"source":"security-advisories@github.com","url":"https://github.com/Intermesh/groupoffice/security/advisories/GHSA-jw34-6g49-r6cw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-80"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63079.json b/data/2026/CVE-2026-63079.json
new file mode 100644
index 0000000000..06e6af05ff
--- /dev/null
+++ b/data/2026/CVE-2026-63079.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Integra32 Security Management System","vendor":"RBH Access Technologies","versions":[{"status":"affected","version":"5.1.11 R5.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\\SYSTEM and fully compromise the host."}],"id":"CVE-2026-63079","lastModified":"2026-11-13T16:19:30.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T16:19:30.253","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/VAMorales/b981c0062a9a7e8942439f97246669b6"},{"source":"disclosure@vulncheck.com","url":"https://rbh-access.com/software/integra32/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rbh-integra32-net-remoting-deserialization-rce"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-66333.json b/data/2026/CVE-2026-66333.json
index 07f691568e..21748778a9 100644
--- a/data/2026/CVE-2026-66333.json
+++ b/data/2026/CVE-2026-66333.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AptioV","vendor":"AMI","versions":[{"lessThan":"AptioV_5.046","status":"affected","version":"AptioV_5.0","versionType":"custom"}]}],"source":"biossecurity@ami.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AMI APTIOV contains vulnerabilities in BIOS where\nprivileged users may cause the “Out-of-Bounds Read” by\nlocal access. Successful exploitation of this vulnerability may lead to a\ndenial of service during firmware update processing, such as a crash or failed\nupdate if the out-of-bounds read hits unmapped memory. It could also impact\nConfidentiality, and Availability."}],"id":"CVE-2026-66333","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"biossecurity@ami.com","type":"Secondary"}]},"published":"2026-11-10T17:17:46.603","references":[{"source":"biossecurity@ami.com","url":"https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026003.pdf"}],"sourceIdentifier":"biossecurity@ami.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"biossecurity@ami.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AptioV","vendor":"AMI","versions":[{"lessThan":"AptioV_5.046","status":"affected","version":"AptioV_5.0","versionType":"custom"}]}],"source":"biossecurity@ami.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AMI APTIOV contains vulnerabilities in BIOS where\nprivileged users may cause the “Out-of-Bounds Read” by\nlocal access. Successful exploitation of this vulnerability may lead to a\ndenial of service during firmware update processing, such as a crash or failed\nupdate if the out-of-bounds read hits unmapped memory. It could also impact\nConfidentiality, and Availability."}],"id":"CVE-2026-66333","lastModified":"2026-11-13T15:17:55.643","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"biossecurity@ami.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-66333","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:48.607394Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:46.603","references":[{"source":"biossecurity@ami.com","url":"https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026003.pdf"}],"sourceIdentifier":"biossecurity@ami.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"biossecurity@ami.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-66334.json b/data/2026/CVE-2026-66334.json
index 7528d1000f..5a00c4d509 100644
--- a/data/2026/CVE-2026-66334.json
+++ b/data/2026/CVE-2026-66334.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AptioV","vendor":"AMI","versions":[{"lessThan":"AptioV_5.046","status":"affected","version":"AptioV_5.0","versionType":"custom"}]}],"source":"biossecurity@ami.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AMI APTIOV contains vulnerabilities in BIOS where\nprivileged users may cause the “Out-of-Bounds Write” by\nlocal access. Successful exploitation of this vulnerability may lead to a\ndenial of service during firmware update processing, such as a crash or failed\nupdate if the out-of-bounds write hits unmapped memory. It could also impact Integrity, and Availability."}],"id":"CVE-2026-66334","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"biossecurity@ami.com","type":"Secondary"}]},"published":"2026-11-10T17:17:46.733","references":[{"source":"biossecurity@ami.com","url":"https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026003.pdf"}],"sourceIdentifier":"biossecurity@ami.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"biossecurity@ami.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AptioV","vendor":"AMI","versions":[{"lessThan":"AptioV_5.046","status":"affected","version":"AptioV_5.0","versionType":"custom"}]}],"source":"biossecurity@ami.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AMI APTIOV contains vulnerabilities in BIOS where\nprivileged users may cause the “Out-of-Bounds Write” by\nlocal access. Successful exploitation of this vulnerability may lead to a\ndenial of service during firmware update processing, such as a crash or failed\nupdate if the out-of-bounds write hits unmapped memory. It could also impact Integrity, and Availability."}],"id":"CVE-2026-66334","lastModified":"2026-11-13T15:17:55.760","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"biossecurity@ami.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-66334","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:50.898658Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:46.733","references":[{"source":"biossecurity@ami.com","url":"https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026003.pdf"}],"sourceIdentifier":"biossecurity@ami.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"biossecurity@ami.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-66335.json b/data/2026/CVE-2026-66335.json
index 910222ec60..b4056c7a31 100644
--- a/data/2026/CVE-2026-66335.json
+++ b/data/2026/CVE-2026-66335.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AptioV","vendor":"AMI","versions":[{"lessThan":"AptioV_5.045","status":"affected","version":"AptioV_5.0","versionType":"custom"}]}],"source":"biossecurity@ami.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AMI APTIOV contains vulnerabilities in BIOS where\nprivileged users may cause the “Heap-based Buffer Overflow” by local access.\nSuccessful exploitation of this vulnerability may lead to a denial of service\nduring firmware update processing, such as a crash or failed update if the\nout-of-bounds write hits unmapped memory. It could also impact Confidentiality,\nIntegrity, and Availability."}],"id":"CVE-2026-66335","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"biossecurity@ami.com","type":"Secondary"}]},"published":"2026-11-10T17:17:46.873","references":[{"source":"biossecurity@ami.com","url":"https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026003.pdf"}],"sourceIdentifier":"biossecurity@ami.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AptioV","vendor":"AMI","versions":[{"lessThan":"AptioV_5.045","status":"affected","version":"AptioV_5.0","versionType":"custom"}]}],"source":"biossecurity@ami.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AMI APTIOV contains vulnerabilities in BIOS where\nprivileged users may cause the “Heap-based Buffer Overflow” by local access.\nSuccessful exploitation of this vulnerability may lead to a denial of service\nduring firmware update processing, such as a crash or failed update if the\nout-of-bounds write hits unmapped memory. It could also impact Confidentiality,\nIntegrity, and Availability."}],"id":"CVE-2026-66335","lastModified":"2026-11-13T15:17:55.890","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"biossecurity@ami.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-66335","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:53.197614Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:46.873","references":[{"source":"biossecurity@ami.com","url":"https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026003.pdf"}],"sourceIdentifier":"biossecurity@ami.com","vulnStatus":"Awaiting Analysis"}
diff --git a/data/2026/CVE-2026-75489.json b/data/2026/CVE-2026-75489.json
index 3b967cc4e1..f68ca1a1c8 100644
--- a/data/2026/CVE-2026-75489.json
+++ b/data/2026/CVE-2026-75489.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points."}],"id":"CVE-2026-75489","lastModified":"2026-11-13T10:18:16.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:16.313","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-smt-message-forgery-via-probe-request-vendor-ie"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points."}],"id":"CVE-2026-75489","lastModified":"2026-11-13T16:19:30.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-75489","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:52.701235Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:16.313","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-smt-message-forgery-via-probe-request-vendor-ie"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-75493.json b/data/2026/CVE-2026-75493.json
index d1537e1672..362e9ddd46 100644
--- a/data/2026/CVE-2026-75493.json
+++ b/data/2026/CVE-2026-75493.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service."}],"id":"CVE-2026-75493","lastModified":"2026-11-13T10:18:16.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:16.883","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-stack-buffer-overflow-via-obuspa-keypassphrase-getter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service."}],"id":"CVE-2026-75493","lastModified":"2026-11-13T16:19:31.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-75493","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:50.212575Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:16.883","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-stack-buffer-overflow-via-obuspa-keypassphrase-getter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-75577.json b/data/2026/CVE-2026-75577.json
index de0d144b03..46fd063e14 100644
--- a/data/2026/CVE-2026-75577.json
+++ b/data/2026/CVE-2026-75577.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command."}],"id":"CVE-2026-75577","lastModified":"2026-11-13T10:18:17.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:17.450","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-vpn-export-conf-wireguard-private-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TR3000 1.0","vendor":"Shenzhen Cudy Technology Co., Ltd.","versions":[{"lessThan":"2.5.42","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.5.42","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command."}],"id":"CVE-2026-75577","lastModified":"2026-11-13T16:19:32.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-75577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:39.732052Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:17.450","references":[{"source":"disclosure@vulncheck.com","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"source":"disclosure@vulncheck.com","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-vpn-export-conf-wireguard-private-key"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-76844.json b/data/2026/CVE-2026-76844.json
index c9a07b42e4..8c855ac7f1 100644
--- a/data/2026/CVE-2026-76844.json
+++ b/data/2026/CVE-2026-76844.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/madler/zlib","product":"zlib","vendor":"zlib","versions":[{"lessThanOrEqual":"1.3.2","status":"affected","version":"1.2.11","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."},{"lang":"es","value":"zlib 1.2.11 hasta 1.3.2 contiene un desbordamiento de búfer de montón: después de que falle una llamada subyacente a write(), gz_write() retorna sin restablecer strm.next_in, dejándolo apuntando al búfer del llamador. Una llamada posterior de escritura gz entonces deriva una posición a partir del puntero obsoleto y escribe más allá de una asignación de montón; cualquier fallo de write() lo alcanza, incluyendo EPIPE en un descriptor de bloqueo, y en versiones anteriores a la 1.3.1.2 la escritura fallida debe ir seguida de una llamada a gzclearerr()."}],"id":"CVE-2026-76844","lastModified":"2026-10-12T17:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76844","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-26T18:22:33.313523Z","version":"2.0.3"}}]},"published":"2026-08-24T14:17:02.250","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"},{"source":"disclosure@vulncheck.com","url":"https://github.com/madler/zlib"},{"source":"disclosure@vulncheck.com","url":"https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"},{"source":"disclosure@vulncheck.com","url":"https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://www.npmjs.com/package/webpack-dev-middleware","defaultStatus":"unaffected","packageName":"webpack-dev-middleware","packageURL":"pkg:npm/webpack-dev-middleware","product":"webpack-dev-middleware","vendor":"webpack","versions":[{"lessThanOrEqual":"5.3.4","status":"affected","version":"5.3.4","versionType":"semver"},{"lessThanOrEqual":"6.1.3","status":"affected","version":"6.1.2","versionType":"semver"},{"lessThan":"7.4.6","status":"affected","version":"7.1.0","versionType":"semver"},{"status":"unaffected","version":"7.4.6","versionType":"semver"},{"lessThan":"8.3.0","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem."},{"lang":"es","value":"zlib 1.2.11 hasta 1.3.2 contiene un desbordamiento de búfer de montón: después de que falle una llamada subyacente a write(), gz_write() retorna sin restablecer strm.next_in, dejándolo apuntando al búfer del llamador. Una llamada posterior de escritura gz entonces deriva una posición a partir del puntero obsoleto y escribe más allá de una asignación de montón; cualquier fallo de write() lo alcanza, incluyendo EPIPE en un descriptor de bloqueo, y en versiones anteriores a la 1.3.1.2 la escritura fallida debe ir seguida de una llamada a gzclearerr()."}],"id":"CVE-2026-76844","lastModified":"2026-11-13T15:17:56.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76844","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-26T18:22:33.313523Z","version":"2.0.3"}}]},"published":"2026-08-24T14:17:02.250","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/advisories/GHSA-wr3j-pwj9-hqq6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webpack/webpack-dev-middleware"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-76877.json b/data/2026/CVE-2026-76877.json
index 139cfe5988..637bb100c5 100644
--- a/data/2026/CVE-2026-76877.json
+++ b/data/2026/CVE-2026-76877.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WPML Multilingual CMS","vendor":"WPML","versions":[{"lessThanOrEqual":"4.9.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the logout landing page, where the browser has already discarded its authentication cookies — so `wp_get_session_token()` returns an empty string and the token collapses to the shared anonymous nonce for the current 12-hour tick rather than a user-bound secret — and then storing it in the `wpml_sso_user_<token>_<sha256('wpml_sso'.$domain)>` transient mapped to the victim's `user_id` with no binding to the specific sign-out action or requesting client. Because an unauthenticated attacker can independently derive the identical token by triggering the logout confirmation flow on `wp-login.php?action=logout`, and because the `is_iframe_request()` gate conditions (the per-domain SSO `started` transient and domain-hash derived from the public constant `SSO_NONCE`) are fully computable within the 60-second `SSO_TIMEOUT` window, an unauthenticated attacker can submit the forged `wpml_sso_token_domain` parameter with a `wpml_user_signed_in` status to a secondary language-domain endpoint before the legitimate `wpml_user_signed_out` iframe fires, causing WordPress authentication cookies to be issued for the victim. This makes it possible for unauthenticated attackers to gain access to accounts of users — including administrators — who are actively in the process of logging out during the race window."}],"id":"CVE-2026-76877","lastModified":"2026-11-11T15:17:24.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}]},"published":"2026-11-10T07:16:52.463","references":[{"source":"security@wordfence.com","url":"https://wpml.org/"},{"source":"security@wordfence.com","url":"https://wpml.org/version/wpml-5-0-0/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/006d1fcd-77b4-4214-be71-b6d71afad072?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@wordfence.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WPML Multilingual CMS","vendor":"WPML","versions":[{"lessThanOrEqual":"4.9.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the logout landing page, where the browser has already discarded its authentication cookies — so `wp_get_session_token()` returns an empty string and the token collapses to the shared anonymous nonce for the current 12-hour tick rather than a user-bound secret — and then storing it in the `wpml_sso_user_<token>_<sha256('wpml_sso'.$domain)>` transient mapped to the victim's `user_id` with no binding to the specific sign-out action or requesting client. Because an unauthenticated attacker can independently derive the identical token by triggering the logout confirmation flow on `wp-login.php?action=logout`, and because the `is_iframe_request()` gate conditions (the per-domain SSO `started` transient and domain-hash derived from the public constant `SSO_NONCE`) are fully computable within the 60-second `SSO_TIMEOUT` window, an unauthenticated attacker can submit the forged `wpml_sso_token_domain` parameter with a `wpml_user_signed_in` status to a secondary language-domain endpoint before the legitimate `wpml_user_signed_out` iframe fires, causing WordPress authentication cookies to be issued for the victim. This makes it possible for unauthenticated attackers to gain access to accounts of users — including administrators — who are actively in the process of logging out during the race window."}],"id":"CVE-2026-76877","lastModified":"2026-11-13T15:17:56.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76877","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:58:15.838219Z","version":"2.0.3"}}]},"published":"2026-11-10T07:16:52.463","references":[{"source":"security@wordfence.com","url":"https://wpml.org/"},{"source":"security@wordfence.com","url":"https://wpml.org/version/wpml-5-0-0/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/006d1fcd-77b4-4214-be71-b6d71afad072?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-77706.json b/data/2026/CVE-2026-77706.json
index fb5dbe1014..be44c8d6eb 100644
--- a/data/2026/CVE-2026-77706.json
+++ b/data/2026/CVE-2026-77706.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"FileOrbis NextGen FileServer","vendor":"Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi","versions":[{"lessThan":"12.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi FileOrbis NextGen FileServer allows Sustained Client Engagement.\n\nThis issue affects FileOrbis NextGen FileServer: before 12.7."}],"id":"CVE-2026-77706","lastModified":"2026-11-13T14:18:00.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-13T14:18:00.377","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1540"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"FileOrbis NextGen FileServer","vendor":"Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi","versions":[{"lessThan":"12.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi FileOrbis NextGen FileServer allows Sustained Client Engagement.\n\nThis issue affects FileOrbis NextGen FileServer: before 12.7."}],"id":"CVE-2026-77706","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-13T14:18:00.377","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1540"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-82174.json b/data/2026/CVE-2026-82174.json
new file mode 100644
index 0000000000..34e4164a5e
--- /dev/null
+++ b/data/2026/CVE-2026-82174.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing."}],"id":"CVE-2026-82174","lastModified":"2026-11-13T16:19:33.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T16:19:33.940","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-451"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-82175.json b/data/2026/CVE-2026-82175.json
new file mode 100644
index 0000000000..5e55df384c
--- /dev/null
+++ b/data/2026/CVE-2026-82175.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance."}],"id":"CVE-2026-82175","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T15:17:56.350","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-82177.json b/data/2026/CVE-2026-82177.json
index f0f06eaa2f..591933c719 100644
--- a/data/2026/CVE-2026-82177.json
+++ b/data/2026/CVE-2026-82177.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance."}],"id":"CVE-2026-82177","lastModified":"2026-11-13T14:18:00.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.503","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance."}],"id":"CVE-2026-82177","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.503","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-82179.json b/data/2026/CVE-2026-82179.json
index ac5b1acbe5..3befd3546c 100644
--- a/data/2026/CVE-2026-82179.json
+++ b/data/2026/CVE-2026-82179.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an authorization bypass vulnerability. An authenticated administrator could exploit this vulnerability to bypass multi-approver controls on critical operations."}],"id":"CVE-2026-82179","lastModified":"2026-11-13T14:18:00.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.637","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an authorization bypass vulnerability. An authenticated administrator could exploit this vulnerability to bypass multi-approver controls on critical operations."}],"id":"CVE-2026-82179","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.637","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-85091.json b/data/2026/CVE-2026-85091.json
index fed664d448..bff1cbf68e 100644
--- a/data/2026/CVE-2026-85091.json
+++ b/data/2026/CVE-2026-85091.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/madler/zlib","product":"zlib","vendor":"zlib","versions":[{"lessThanOrEqual":"1.3.2","status":"affected","version":"1.3.1.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}],"id":"CVE-2026-85091","lastModified":"2026-09-09T20:41:07.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-85091","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-03T13:21:12.950523Z","version":"2.0.3"}}]},"published":"2026-09-03T13:06:20.573","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"},{"source":"disclosure@vulncheck.com","url":"https://github.com/madler/zlib"},{"source":"disclosure@vulncheck.com","url":"https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/madler/zlib","product":"zlib","vendor":"zlib","versions":[{"lessThanOrEqual":"1.3.2","status":"affected","version":"1.2.11","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."}],"id":"CVE-2026-85091","lastModified":"2026-11-13T15:17:56.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-85091","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-03T13:21:12.950523Z","version":"2.0.3"}}]},"published":"2026-09-03T13:06:20.573","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"},{"source":"disclosure@vulncheck.com","url":"https://github.com/madler/zlib"},{"source":"disclosure@vulncheck.com","url":"https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"},{"source":"disclosure@vulncheck.com","url":"https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-86323.json b/data/2026/CVE-2026-86323.json
index 295693017c..9bde48cafe 100644
--- a/data/2026/CVE-2026-86323.json
+++ b/data/2026/CVE-2026-86323.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user."}],"id":"CVE-2026-86323","lastModified":"2026-11-13T02:18:59.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-12T21:17:33.223","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-86323"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529290"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user."}],"id":"CVE-2026-86323","lastModified":"2026-11-13T16:19:34.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:39:28.245266Z","version":"2.0.3"}}]},"published":"2026-11-12T21:17:33.223","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-86323"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529290"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-86353.json b/data/2026/CVE-2026-86353.json
index 7c9fea9e53..b11ac71d16 100644
--- a/data/2026/CVE-2026-86353.json
+++ b/data/2026/CVE-2026-86353.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existing privileged access to the appliance to recover stored credentials."}],"id":"CVE-2026-86353","lastModified":"2026-11-13T14:18:00.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":4.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.903","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existing privileged access to the appliance to recover stored credentials."}],"id":"CVE-2026-86353","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":4.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.903","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-86355.json b/data/2026/CVE-2026-86355.json
index 7d4d0b09fb..fe502f9ba1 100644
--- a/data/2026/CVE-2026-86355.json
+++ b/data/2026/CVE-2026-86355.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance."}],"id":"CVE-2026-86355","lastModified":"2026-11-13T13:18:29.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:18:29.887","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance."}],"id":"CVE-2026-86355","lastModified":"2026-11-13T16:19:35.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86355","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:41.902083Z","version":"2.0.3"}}]},"published":"2026-11-13T13:18:29.887","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-86356.json b/data/2026/CVE-2026-86356.json
index 9851108df2..837917477f 100644
--- a/data/2026/CVE-2026-86356.json
+++ b/data/2026/CVE-2026-86356.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator."}],"id":"CVE-2026-86356","lastModified":"2026-11-13T13:18:30.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:18:30.020","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator."}],"id":"CVE-2026-86356","lastModified":"2026-11-13T16:19:36.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:51:06.375031Z","version":"2.0.3"}}]},"published":"2026-11-13T13:18:30.020","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92439.json b/data/2026/CVE-2026-92439.json
index 5ca73934df..0ae0d840e0 100644
--- a/data/2026/CVE-2026-92439.json
+++ b/data/2026/CVE-2026-92439.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed to authenticate to Kong."}],"id":"CVE-2026-92439","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.740","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed to authenticate to Kong."}],"id":"CVE-2026-92439","lastModified":"2026-11-13T15:17:56.660","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92439","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:32:01.854693Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:14.740","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92441.json b/data/2026/CVE-2026-92441.json
index 65c99ddc7a..174d318fff 100644
--- a/data/2026/CVE-2026-92441.json
+++ b/data/2026/CVE-2026-92441.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream."}],"id":"CVE-2026-92441","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.867","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream."}],"id":"CVE-2026-92441","lastModified":"2026-11-13T15:17:56.773","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92441","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:31:26.298323Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:14.867","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92442.json b/data/2026/CVE-2026-92442.json
index c6d2899d8f..4d46aaf0d8 100644
--- a/data/2026/CVE-2026-92442.json
+++ b/data/2026/CVE-2026-92442.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another."}],"id":"CVE-2026-92442","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.987","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another."}],"id":"CVE-2026-92442","lastModified":"2026-11-13T15:17:56.887","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:33:46.740282Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:14.987","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92545.json b/data/2026/CVE-2026-92545.json
index 33fac3aef8..4f55d58a1f 100644
--- a/data/2026/CVE-2026-92545.json
+++ b/data/2026/CVE-2026-92545.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another."}],"id":"CVE-2026-92545","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.290","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another."}],"id":"CVE-2026-92545","lastModified":"2026-11-13T15:17:57.000","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92545","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:37:03.824963Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:15.290","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-95377.json b/data/2026/CVE-2026-95377.json
new file mode 100644
index 0000000000..3e2c3c9540
--- /dev/null
+++ b/data/2026/CVE-2026-95377.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["TFTP provisioning"],"packageName":"EdgeAudioClient","platforms":["Linux","ARM","32 bit"],"product":"VSFF6","vendor":"Zenitel","versions":[{"lessThan":"9.6.3.0","status":"affected","version":"0","versionType":"custom"},{"lessThan":"10.1.3.0","status":"affected","version":"10.0.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["TFTP provisioning"],"packageName":"EdgeAudioClient","platforms":["Linux","ARM","64 bit"],"product":"VSFF8","vendor":"Zenitel","versions":[{"lessThan":"9.6.3.0","status":"affected","version":"0","versionType":"custom"},{"lessThan":"10.1.3.0","status":"affected","version":"10.0.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["TFTP provisioning"],"packageName":"EdgeAudioClient","platforms":["Linux","ARM","64 bit"],"product":"VSFF8MP","vendor":"Zenitel","versions":[{"lessThan":"9.6.3.0","status":"affected","version":"0","versionType":"custom"},{"lessThan":"10.1.3.0","status":"affected","version":"10.0.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["TFTP provisioning"],"packageName":"EdgeAudioClient","platforms":["Linux","ARM","64 bit"],"product":"VSFF8MN","vendor":"Zenitel","versions":[{"lessThan":"9.6.3.0","status":"affected","version":"0","versionType":"custom"},{"lessThan":"10.1.3.0","status":"affected","version":"10.0.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["TFTP provisioning"],"packageName":"EdgeAudioClient","platforms":["Linux","ARM","32 bit"],"product":"VSFT","vendor":"Zenitel","versions":[{"lessThan":"9.6.3.0","status":"affected","version":"0","versionType":"custom"},{"lessThan":"10.1.3.0","status":"affected","version":"10.0.0.0","versionType":"custom"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.\n\n\n\nThe same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration."}],"id":"CVE-2026-95377","lastModified":"2026-11-13T16:19:37.337","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"PRESENT","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:19:37.337","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-95378.json b/data/2026/CVE-2026-95378.json
new file mode 100644
index 0000000000..1befd96c00
--- /dev/null
+++ b/data/2026/CVE-2026-95378.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Certificate upload"],"packageName":"turbineweb","platforms":["Linux","ARM","32 bit"],"product":"VSFF6","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["Certificate upload"],"packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["Certificate upload"],"packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8MP","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["Certificate upload"],"packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8MN","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["Certificate upload"],"packageName":"turbineweb","platforms":["Linux","ARM","32 bit"],"product":"VSFT","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys."}],"id":"CVE-2026-95378","lastModified":"2026-11-13T16:19:37.510","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"PRESENT","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:19:37.510","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-434"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-95379.json b/data/2026/CVE-2026-95379.json
new file mode 100644
index 0000000000..417b66fb5e
--- /dev/null
+++ b/data/2026/CVE-2026-95379.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Certificate delete"],"packageName":"turbineweb","platforms":["Linux","ARM","32 bit"],"product":"VSFF6","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["Certificate delete"],"packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["Certificate delete"],"packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8MP","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["Certificate delete"],"packageName":"turbineweb","platforms":["Linux","ARM","64 bit"],"product":"VSFF8MN","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["Certificate delete"],"packageName":"turbineweb","platforms":["Linux","ARM","32 bit"],"product":"VSFT","vendor":"Zenitel","versions":[{"lessThan":"10.1.3.0","status":"affected","version":"10.0.3.0","versionType":"custom"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.\n\n\n\nThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores."}],"id":"CVE-2026-95379","lastModified":"2026-11-13T16:19:38.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"PRESENT","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:19:38.563","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-95518.json b/data/2026/CVE-2026-95518.json
index d0fa8f7df1..22f87a4037 100644
--- a/data/2026/CVE-2026-95518.json
+++ b/data/2026/CVE-2026-95518.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pardus Package Installer","vendor":"TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü","versions":[{"lessThan":"0.7.1","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü Pardus Package Installer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.\n\nThis issue affects Pardus Package Installer: from 0.7.0 before 0.7.1."}],"id":"CVE-2026-95518","lastModified":"2026-11-13T13:18:31.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-13T13:18:31.217","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1539"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pardus Package Installer","vendor":"TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü","versions":[{"lessThan":"0.7.1","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü Pardus Package Installer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.\n\nThis issue affects Pardus Package Installer: from 0.7.0 before 0.7.1."}],"id":"CVE-2026-95518","lastModified":"2026-11-13T15:40:51.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-13T13:18:31.217","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1539"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-95613.json b/data/2026/CVE-2026-95613.json
new file mode 100644
index 0000000000..4f4509c60b
--- /dev/null
+++ b/data/2026/CVE-2026-95613.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Zenitel Connect","vendor":"Zenitel","versions":[{"lessThan":"1.11.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the \"postgres\" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API."}],"id":"CVE-2026-95613","lastModified":"2026-11-13T16:19:38.717","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:19:38.717","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-653"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-95614.json b/data/2026/CVE-2026-95614.json
new file mode 100644
index 0000000000..b33b7c7bef
--- /dev/null
+++ b/data/2026/CVE-2026-95614.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Zenitel Connect","vendor":"Zenitel","versions":[{"lessThan":"1.11.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file."}],"id":"CVE-2026-95614","lastModified":"2026-11-13T16:19:38.853","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:19:38.853","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-15"},{"lang":"en","value":"CWE-653"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-95615.json b/data/2026/CVE-2026-95615.json
new file mode 100644
index 0000000000..a772b85779
--- /dev/null
+++ b/data/2026/CVE-2026-95615.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Zenitel Connect","vendor":"Zenitel","versions":[{"lessThan":"1.11.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint."}],"id":"CVE-2026-95615","lastModified":"2026-11-13T16:19:38.987","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]},"published":"2026-11-13T16:19:38.987","references":[{"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}],"sourceIdentifier":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-96437.json b/data/2026/CVE-2026-96437.json
index 447ed79d4a..9e9b71a582 100644
--- a/data/2026/CVE-2026-96437.json
+++ b/data/2026/CVE-2026-96437.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.11","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.4","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.1","status":"affected","version":"3.16.0.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks."}],"id":"CVE-2026-96437","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:17.753","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-636"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.11","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.4","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.1","status":"affected","version":"3.16.0.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks."}],"id":"CVE-2026-96437","lastModified":"2026-11-13T15:17:57.120","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96437","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:32:42.622798Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:17.753","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-636"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-99286.json b/data/2026/CVE-2026-99286.json
index 2ccc3cf994..c66209e310 100644
--- a/data/2026/CVE-2026-99286.json
+++ b/data/2026/CVE-2026-99286.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ade3082dcdee17c5767069883936d64ff83f6c9f","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a97aa838903d15f865d80809f5198ff459c6634a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"07aca7d25ce8578fedde49855983a01c537a782b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6.12.117","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.18.63","status":"affected","version":"0","versionType":"semver"},{"lessThan":"7.3.4","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.117","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.63","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.4","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix XenBus connection failure cleanup\n\nxenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues\nunder rcu_read_lock. We need to unpublish vif->num_queues before\nsynchronize_net to ensure that readers that come afterwards will not\nread a non-zero vif->num_queues and attempt to access invalid queues.\n\nThis is the same cleanup algorithm as used in backend_disconnect and\nadded in commit b17075d5c198 (\"xen-netback: fix race condition on XenBus\ndisconnect\").\n\nThis is XSA-531"}],"id":"CVE-2026-99286","lastModified":"2026-11-10T21:22:22.900","metrics":{},"published":"2026-11-10T19:22:31.930","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/07aca7d25ce8578fedde49855983a01c537a782b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a97aa838903d15f865d80809f5198ff459c6634a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ade3082dcdee17c5767069883936d64ff83f6c9f"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/25"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-531.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ade3082dcdee17c5767069883936d64ff83f6c9f","status":"affected","version":"6cd611d2abdd8623a554e14145f82c1cb4e4467a","versionType":"git"},{"lessThan":"a97aa838903d15f865d80809f5198ff459c6634a","status":"affected","version":"37d5a73170579b30e67cc8b19ec69715eea3a6b6","versionType":"git"},{"lessThan":"07aca7d25ce8578fedde49855983a01c537a782b","status":"affected","version":"4867687b6ad28ab84bc0811d8f8f9972e769da02","versionType":"git"},{"status":"affected","version":"5fb756f1bbec7a3862dda5d79028bf656271804c","versionType":"git"},{"status":"affected","version":"4223b33be49ee09acb6f1d26beb4a36dd3b8d63a","versionType":"git"},{"status":"affected","version":"ab9cdf1291be551da999510b30216a2886074d7a","versionType":"git"},{"status":"affected","version":"36f858f228e3f955b9336af7f94634747c221518","versionType":"git"},{"status":"affected","version":"89e534265b62c94749639350200b10370564bb3a","versionType":"git"},{"lessThan":"6.12.117","status":"affected","version":"6.12.116","versionType":"semver"},{"lessThan":"6.18.63","status":"affected","version":"6.18.62","versionType":"semver"},{"lessThan":"7.3.4","status":"affected","version":"7.3.3","versionType":"semver"},{"lessThan":"5.11","status":"affected","version":"5.10.274","versionType":"semver"},{"lessThan":"5.16","status":"affected","version":"5.15.225","versionType":"semver"},{"lessThan":"6.2","status":"affected","version":"6.1.192","versionType":"semver"},{"lessThan":"6.7","status":"affected","version":"6.6.162","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/xen-netback/xenbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.4-rc2"},{"lessThan":"7.4-rc2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.117","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.63","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.4","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix XenBus connection failure cleanup\n\nxenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues\nunder rcu_read_lock. We need to unpublish vif->num_queues before\nsynchronize_net to ensure that readers that come afterwards will not\nread a non-zero vif->num_queues and attempt to access invalid queues.\n\nThis is the same cleanup algorithm as used in backend_disconnect and\nadded in commit b17075d5c198 (\"xen-netback: fix race condition on XenBus\ndisconnect\").\n\nThis is XSA-531"}],"id":"CVE-2026-99286","lastModified":"2026-11-13T15:17:57.230","metrics":{},"published":"2026-11-10T19:22:31.930","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/07aca7d25ce8578fedde49855983a01c537a782b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a97aa838903d15f865d80809f5198ff459c6634a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ade3082dcdee17c5767069883936d64ff83f6c9f"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/25"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-531.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
diff --git a/data/2026/CVE-2026-99288.json b/data/2026/CVE-2026-99288.json
index 06ab9f0de1..5cc2ac9464 100644
--- a/data/2026/CVE-2026-99288.json
+++ b/data/2026/CVE-2026-99288.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/inet_connection_sock.c","net/ipv4/inet_hashtables.c","net/ipv4/syncookies.c","net/ipv4/tcp_input.c","net/ipv6/inet6_hashtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d69100340b4cae08d40f898f1b601032403f6be6","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"eb8a2d156f2c1d862fffdfd1b3432bfbcd939879","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/inet_connection_sock.c","net/ipv4/inet_hashtables.c","net/ipv4/syncookies.c","net/ipv4/tcp_input.c","net/ipv6/inet6_hashtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.4"},{"lessThan":"4.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.117","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.63","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.4","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ninet: reject unhashed sockets during established lookups\n\nTCP established ehash lookups are lockless. The socket caches involved\nuse SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader\nthat retained its old address has finished.\n\nAfter a tuple match, __inet_lookup_established() and\n__inet6_lookup_established() acquire a reference and repeat the tuple\ncheck. They do not check whether the new object is hashed. If the\naddress is reused for a socket with the same tuple, the lookup can\nacquire a reference to the new object and return it while its nulls node\nis unhashed.\n\nA PoC that drives reuse with a SYN cookie request socket reproduced the\ncrash. The new request socket is unhashed and has a NULL rsk_listener.\nA lookup that had loaded the address of the old request socket acquired\nthe reference published by tcp_get_cookie_sock() and returned the new\nobject. tcp_v4_rcv() then read sk_state through the NULL listener.\n\nThe resulting crash was:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000012\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  ...\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy)\n  ...\n  RIP: 0010:tcp_v4_rcv+0x44e/0x1280\n  ...\n  R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000\n  ...\n  CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0\n  ...\n  Call Trace:\n   <IRQ>\n   ? raw_local_deliver+0xae/0x240\n   ip_protocol_deliver_rcu+0x2d/0x180\n   ip_local_deliver_finish+0x84/0x100\n   ip_sublist_rcv_finish+0x5f/0x70\n   ip_sublist_rcv+0x12a/0x1d0\n   ip_list_rcv+0xfd/0x130\n   __netif_receive_skb_list_core+0x223/0x250\n   netif_receive_skb_list_internal+0x1d2/0x2c0\n   ? try_fill_recv+0x39/0x7b0\n   napi_complete_done+0x74/0x170\n   virtnet_poll+0x445/0x600\n   __napi_poll+0x27/0x1e0\n   net_rx_action+0x2fe/0x3b0\n   handle_softirqs+0xc2/0x2c0\n   __irq_exit_rcu+0x74/0xd0\n   common_interrupt+0x7f/0x90\n   </IRQ>\n  ...\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nAfter taking a reference, check whether the nulls node is unhashed in\nboth IPv4 and IPv6 established lookups. If it is unhashed or the tuple\nno longer matches, drop the reference and restart the lookup.\n\nLookups racing with the TIME_WAIT hashdance, or with a request being\nreplaced by its child, now restart and find the new socket instead of\nreturning the old one.\n\nRequest sockets that were never inserted into ehash can have a nonzero\nrefcount, and a stale lookup can hold a transient reference. Therefore,\nwhen SYN cookie, Fast Open, and request migration paths fail after\nsetting a nonzero refcount, release the references held by those paths\nwith reqsk_put() instead of freeing the request directly."}],"id":"CVE-2026-99288","lastModified":"2026-11-10T19:22:32.170","metrics":{},"published":"2026-11-10T19:22:32.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d69100340b4cae08d40f898f1b601032403f6be6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/eb8a2d156f2c1d862fffdfd1b3432bfbcd939879"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/inet_connection_sock.c","net/ipv4/inet_hashtables.c","net/ipv4/syncookies.c","net/ipv4/tcp_input.c","net/ipv6/inet6_hashtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d69100340b4cae08d40f898f1b601032403f6be6","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"eb8a2d156f2c1d862fffdfd1b3432bfbcd939879","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"4e2b3ef19e0e04adca38442f07dd6bc93c712bf1","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/inet_connection_sock.c","net/ipv4/inet_hashtables.c","net/ipv4/syncookies.c","net/ipv4/tcp_input.c","net/ipv6/inet6_hashtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.4"},{"lessThan":"4.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.117","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.63","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ninet: reject unhashed sockets during established lookups\n\nTCP established ehash lookups are lockless. The socket caches involved\nuse SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader\nthat retained its old address has finished.\n\nAfter a tuple match, __inet_lookup_established() and\n__inet6_lookup_established() acquire a reference and repeat the tuple\ncheck. They do not check whether the new object is hashed. If the\naddress is reused for a socket with the same tuple, the lookup can\nacquire a reference to the new object and return it while its nulls node\nis unhashed.\n\nA PoC that drives reuse with a SYN cookie request socket reproduced the\ncrash. The new request socket is unhashed and has a NULL rsk_listener.\nA lookup that had loaded the address of the old request socket acquired\nthe reference published by tcp_get_cookie_sock() and returned the new\nobject. tcp_v4_rcv() then read sk_state through the NULL listener.\n\nThe resulting crash was:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000012\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  ...\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy)\n  ...\n  RIP: 0010:tcp_v4_rcv+0x44e/0x1280\n  ...\n  R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000\n  ...\n  CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0\n  ...\n  Call Trace:\n   <IRQ>\n   ? raw_local_deliver+0xae/0x240\n   ip_protocol_deliver_rcu+0x2d/0x180\n   ip_local_deliver_finish+0x84/0x100\n   ip_sublist_rcv_finish+0x5f/0x70\n   ip_sublist_rcv+0x12a/0x1d0\n   ip_list_rcv+0xfd/0x130\n   __netif_receive_skb_list_core+0x223/0x250\n   netif_receive_skb_list_internal+0x1d2/0x2c0\n   ? try_fill_recv+0x39/0x7b0\n   napi_complete_done+0x74/0x170\n   virtnet_poll+0x445/0x600\n   __napi_poll+0x27/0x1e0\n   net_rx_action+0x2fe/0x3b0\n   handle_softirqs+0xc2/0x2c0\n   __irq_exit_rcu+0x74/0xd0\n   common_interrupt+0x7f/0x90\n   </IRQ>\n  ...\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nAfter taking a reference, check whether the nulls node is unhashed in\nboth IPv4 and IPv6 established lookups. If it is unhashed or the tuple\nno longer matches, drop the reference and restart the lookup.\n\nLookups racing with the TIME_WAIT hashdance, or with a request being\nreplaced by its child, now restart and find the new socket instead of\nreturning the old one.\n\nRequest sockets that were never inserted into ehash can have a nonzero\nrefcount, and a stale lookup can hold a transient reference. Therefore,\nwhen SYN cookie, Fast Open, and request migration paths fail after\nsetting a nonzero refcount, release the references held by those paths\nwith reqsk_put() instead of freeing the request directly."}],"id":"CVE-2026-99288","lastModified":"2026-11-13T15:17:57.350","metrics":{},"published":"2026-11-10T19:22:32.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4e2b3ef19e0e04adca38442f07dd6bc93c712bf1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d69100340b4cae08d40f898f1b601032403f6be6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/eb8a2d156f2c1d862fffdfd1b3432bfbcd939879"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Received"}
diff --git a/state/sync.json b/state/sync.json
index e0471a02a4..9dff12bf46 100644
--- a/state/sync.json
+++ b/state/sync.json
@@ -1 +1 @@
-{"initial_complete":true,"last_run_counts":{"seen":5161,"skipped":39,"unchanged":4949,"written":173},"last_run_mode":"incremental","last_successful_end":"2026-11-13T14:42:51+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-13T14:50:25.514067+00:00"}
+{"initial_complete":true,"last_run_counts":{"seen":5253,"skipped":39,"unchanged":4696,"written":518},"last_run_mode":"incremental","last_successful_end":"2026-11-13T16:42:55+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-13T16:48:08.840653+00:00"}