NVD update 2026-11-13T10:48:08Z
This commit is contained in:
Vulnerability Bot committed
1 parent
1170780091
commit
3d9ce4f746
356 files changed
+356
-4
No files matched your search
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.2.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.2.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content."}],"id":"CVE-2023-54423","lastModified":"2026-11-13T10:17:23.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":1.7,"impactScore":5.3,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:23.227","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-9j5w-2cqc-cwj9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.2.0-stored-xss-via-tinymce-wysiwyg-editor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-82"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"3.7.10","status":"affected","version":"3.4.5","versionType":"semver"},{"status":"unaffected","version":"3.7.10","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"3.7.10","status":"affected","version":"3.4.5","versionType":"semver"},{"status":"unaffected","version":"3.7.10","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host."}],"id":"CVE-2024-58404","lastModified":"2026-11-13T10:17:23.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:23.447","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-v38v-92cm-6mx8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-3.4.5-before-3.7.10-path-traversal-via-user-export-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"3.7.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files."}],"id":"CVE-2024-58405","lastModified":"2026-11-13T10:17:23.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:23.610","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/zipline","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.3.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service."}],"id":"CVE-2025-71459","lastModified":"2026-11-13T10:17:23.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:23.780","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.2.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.2.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user."}],"id":"CVE-2025-71460","lastModified":"2026-11-13T10:17:23.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:23.940","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-26wv-mhc3-5xfq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.2.1-missing-ownership-check-via-api-user-files-transaction"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced"}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads."}],"id":"CVE-2025-71461","lastModified":"2026-11-13T10:17:24.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:24.100","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"3.7.12","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.7.12","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login."}],"id":"CVE-2025-71462","lastModified":"2026-11-13T10:17:24.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:24.250","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__()."}],"id":"CVE-2025-71463","lastModified":"2026-11-13T10:17:24.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:24.403","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-cq46-m9x9-j8w2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.7.0-insecure-deserialization-rce-via-session-files"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtbase","qt5compat"],"product":"qt","vendor":"qt","versions":[{"lessThan":"5.0.0","status":"unknown","version":"0","versionType":"python"},{"lessThan":"6.8.9","status":"affected","version":"5.0.0","versionType":"python"},{"lessThan":"6.11.3","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected."}],"id":"CVE-2026-103645","lastModified":"2026-11-13T10:17:24.573","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"CLEAR","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:Clear","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]},"published":"2026-11-13T10:17:24.573","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qt5compat/+/762795"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://www.qt.io/security-advisories?search=CVE-2026-103645"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-835"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]}
|
||||
@@ -1 +1 @@
|
||||
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortisandbox:5.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.2.1","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThanOrEqual":"5.0.6","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"4.4.10","status":"affected","version":"4.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxcloud:5.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.6","status":"affected","version":"5.0.4","versionType":"semver"},{"lessThanOrEqual":"5.0.2","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"4.4.9","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.0.4 through 5.0.6, FortiSandbox Cloud 5.0.0 through 5.0.2, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests"}],"id":"CVE-2026-106172","lastModified":"2026-11-06T16:17:35.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106172","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-10-13T18:17:14.567","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-179"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
|
||||
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortisandbox:5.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.2.1","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThanOrEqual":"5.0.6","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"4.4.10","status":"affected","version":"4.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxcloud:5.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:4.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.2.1","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThanOrEqual":"5.0.6","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"4.4.9","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests"}],"id":"CVE-2026-106172","lastModified":"2026-11-13T10:17:24.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106172","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-10-13T18:17:14.567","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-179"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
|
||||
@@ -1 +1 @@
|
||||
{"affected":[{"affectedData":[{"collectionURL":"https://github.com/quay/quay","defaultStatus":"unaffected","packageName":"quay","product":"quay","vendor":"Project Quay","versions":[{"lessThan":"3.9.28","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.10.28","status":"affected","version":"3.10.0","versionType":"semver"},{"lessThan":"3.12.24","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.10","status":"affected","version":"3.14.0","versionType":"semver"},{"lessThan":"3.15.9","status":"affected","version":"3.15.0","versionType":"semver"},{"lessThan":"3.16.7","status":"affected","version":"3.16.0","versionType":"semver"},{"lessThan":"3.17.7","status":"affected","version":"3.17.0","versionType":"semver"},{"lessThan":"3.18.3","status":"affected","version":"3.18.0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993674","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993854","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.14::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993848","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.15::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993799","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993778","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.18::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993890","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993730","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_update_service:5"],"defaultStatus":"unaffected","packageName":"openshift-update-service/openshift-update-service-rhel8","product":"Red Hat OpenShift Update Service","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:5"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations."}],"id":"CVE-2026-110697","lastModified":"2026-11-13T02:18:50.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110697",Line truncated
|
||||
{"affected":[{"affectedData":[{"collectionURL":"https://github.com/quay/quay","defaultStatus":"unaffected","packageName":"quay","product":"quay","vendor":"Project Quay","versions":[{"lessThan":"3.9.28","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.10.28","status":"affected","version":"3.10.0","versionType":"semver"},{"lessThan":"3.12.24","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.10","status":"affected","version":"3.14.0","versionType":"semver"},{"lessThan":"3.15.9","status":"affected","version":"3.15.0","versionType":"semver"},{"lessThan":"3.16.7","status":"affected","version":"3.16.0","versionType":"semver"},{"lessThan":"3.17.7","status":"affected","version":"3.17.0","versionType":"semver"},{"lessThan":"3.18.3","status":"affected","version":"3.18.0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993674","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993854","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.14::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993848","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.15::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993799","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993778","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.18::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993890","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993730","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:5"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations."}],"id":"CVE-2026-110697","lastModified":"2026-11-13T09:17:31.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:00:41.962595Z","version":"2.0.3"}}]},"published":"2026-11-11T17:17:14.897","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errataLine truncated
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenKM Community Edition","vendor":"OpenKM","versions":[{"lessThanOrEqual":"6.3.13","status":"affected","version":"6.3.3","versionType":"custom"},{"status":"affected","version":"7.0.3"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server."}],"id":"CVE-2026-112181","lastModified":"2026-11-13T10:17:24.907","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}]},"published":"2026-11-13T10:17:24.907","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"cve-coordination@incibe.es","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups","vendor":"renehermi","versions":[{"lessThanOrEqual":"4.19.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint."}],"id":"CVE-2026-115871","lastModified":"2026-11-13T10:17:25.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:25.070","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Administrator.php#L980"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L547"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L630"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L95"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Filesystem/Filesystem.php#L416"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Utils/Sanitize.php#L165"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3787297%40wp-staging&new=3787297%40wp-staging"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access."}],"id":"CVE-2026-116417","lastModified":"2026-11-13T09:17:32.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.160","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-521"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116418","lastModified":"2026-11-13T10:17:25.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:17:25.253","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116419","lastModified":"2026-11-13T09:17:32.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.290","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116420","lastModified":"2026-11-13T09:17:32.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.420","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116421","lastModified":"2026-11-13T09:17:32.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.540","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information exposure."}],"id":"CVE-2026-116422","lastModified":"2026-11-13T09:17:32.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.670","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Improper Verification of Cryptographic Signature vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Information tampering."}],"id":"CVE-2026-116423","lastModified":"2026-11-13T09:17:32.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.797","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains Unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116424","lastModified":"2026-11-13T09:17:32.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.920","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116425","lastModified":"2026-11-13T09:17:33.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.053","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-116426","lastModified":"2026-11-13T09:17:33.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.173","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116427","lastModified":"2026-11-13T09:17:33.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.297","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Version 6.4.0, contain an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering."}],"id":"CVE-2026-116430","lastModified":"2026-11-13T09:17:33.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.427","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116431","lastModified":"2026-11-13T09:17:33.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.557","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"id":"CVE-2026-116433","lastModified":"2026-11-13T10:17:25.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:17:25.507","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"id":"CVE-2026-116436","lastModified":"2026-11-13T09:17:33.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.680","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0 , contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service."}],"id":"CVE-2026-116438","lastModified":"2026-11-13T09:17:33.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.807","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116453","lastModified":"2026-11-13T09:17:33.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.930","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker","vendor":"expresstech","versions":[{"lessThanOrEqual":"11.2.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call."}],"id":"CVE-2026-116509","lastModified":"2026-11-13T10:17:25.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:25.623","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/functions.php#L1135"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1187"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1193"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1209"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/classes/class-qmn-quiz-manager.php#L688"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3779826%40quiz-master-next&new=3779826%40quiz-master-next"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping","vendor":"aukejomm","versions":[{"lessThanOrEqual":"2.24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to generic SQL Injection via the 'sourceId' parameter in all versions up to, and including, 2.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The plugin grants the edit_feeds capability to the Editor role on activation, meaning any Editor-level user satisfies the authorization checks and can exploit this vulnerability."}],"id":"CVE-2026-116614","lastModified":"2026-11-13T10:17:25.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:25.793","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-ajax-data.php#L59"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php#L42"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php#L64"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.2/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3792176"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cecb044-2dba-494f-b85c-41bafa69e330?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","vendor":"marketingfire","versions":[{"lessThanOrEqual":"4.2.6.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter (`widgetopts_strip_logic_from_blocks()`) and the render-time parser (`blockopts_filter_before_display()`): embedding an inner `<!--start_widgetopts` literal inside a JSON key causes the write-side `json_decode` to see a non-`class` key and skip stripping — persisting the payload verbatim to the database — while the render-side `str_replace` reconstitutes the key to `class`, feeding the attacker-controlled `logic` value directly into `@eval`. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary `get_option`, `get_user_meta`, and `get_post_meta` values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the `widgetopts_allowed_php_functions` filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes `widgetopts_safe_eval_trusted()` to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above."}],"id":"CVE-2026-116615","lastModified":"2026-11-13T10:17:26.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:25.983","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/extras.php#L792"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L331"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L377"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L496"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.7/includes/widgets/gutenberg/gutenberg-toolbar.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5e4431-2789-47c8-81ce-e9f67454accc?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery","vendor":"smub","versions":[{"lessThanOrEqual":"4.5.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The 'NextGEN Manage gallery' capability required to reach the vulnerable endpoint is granted to Administrators by default but can be delegated to lower-privileged roles via the plugin's Roles screen."}],"id":"CVE-2026-118191","lastModified":"2026-11-13T10:17:26.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:26.150","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L164"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2395"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2764"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2943"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3793263/nextgen-gallery/trunk/src/Lightroom/Controller.php"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3793263/nextgen-gallery/trunk/src/Lightroom/Controller.php?old=3773860&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FLightroom%2FController.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e01402-f866-43b9-9fef-7e9b156a9e0d?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerPress Podcasting plugin by Blubrry","vendor":"blubrry","versions":[{"lessThanOrEqual":"11.18.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension, as these conditions are required to route the shortcode attributes through the vulnerable powerpressplayer_build_html5video() builder. Successful exploitation additionally requires an action by an editor — the attacker cannot trigger the vulnerability on their own."}],"id":"CVE-2026-118587","lastModified":"2026-11-13T10:17:26.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:26.320","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L1240"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L135"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress?rev=3782100#trunk"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3782099/powerpress/trunk/powerpress-player.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d3930f-d2da-4992-ad3a-228ffd7a5a6c?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ELEX WordPress HelpDesk & Customer Ticketing System","vendor":"elextensions","versions":[{"lessThanOrEqual":"3.3.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack."}],"id":"CVE-2026-119077","lastModified":"2026-11-13T10:17:26.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:26.483","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L156"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L265"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions.php#L946"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L529"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L627"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L822"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php#L45"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3797458/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-public-functions.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f14b07ce-8893-4f8c-a501-5da6ec5a3b8f?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)","vendor":"saadiqbal","versions":[{"lessThanOrEqual":"3.8.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only a meaningful privilege escalation on multisite installations or those with DISALLOW_UNFILTERED_HTML enabled, as Editor-level users on default single-site installs already possess the unfiltered_html capability."}],"id":"CVE-2026-120547","lastModified":"2026-11-13T10:17:26.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:26.650","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L341"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L392"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L415"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L440"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L488"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3772728%40contact-form-7-honeypot&new=3772728%40contact-form-7-honeypot"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3091d345-2532-433c-83e0-2e253a4cd8d4?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WPeMatico RSS Feed Fetcher","vendor":"etruel","versions":[{"lessThanOrEqual":"2.9.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is persisted in post meta as campaign_data, bypassing wp_kses sanitization, and executes in the browser session of any user with edit_posts — including Administrators — who opens the WPeMatico campaigns list screen."}],"id":"CVE-2026-120573","lastModified":"2026-11-13T10:17:26.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:26.817","references":[{"source":"security@wordfence.com","url":"https://github.com/etruel/wpematico/tree/2.9.2"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaign_edit.php#L540"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaigns_list.php#L820"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/wpematico_functions.php#L1106"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93d4360-b66c-499a-838c-e8eea36bd364?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Download Manager","vendor":"codename065","versions":[{"lessThanOrEqual":"7.6.3","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additional_previews][]' parameter in all versions up to, and including, 7.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpdm_sanitize_array() function strips HTML tags via wp_kses but leaves bare single quotes intact and calls stripslashes_deep() which defeats WordPress magic quotes protection, allowing a single-quote-based attribute breakout payload to be stored verbatim and later rendered without escaping."}],"id":"CVE-2026-120658","lastModified":"2026-11-13T10:17:27.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:26.977","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L113"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L169"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/PackageController.php#L2296"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4085834-3865-4b9e-9497-f14e6e32554b?source=cve"},{"source":"security@wordfence.com","url":"https://www.wpdownloadmanager.com/changelogs/"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"EZ SQL Reports Shortcode Widget and DB Backup","vendor":"scheeeli","versions":[{"lessThanOrEqual":"5.25.25","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have saved a SQL report that selects an attacker-controllable database column, such as wp_comments.comment_agent, which WordPress stores verbatim from unauthenticated visitors even when comments are pending moderation."}],"id":"CVE-2026-120688","lastModified":"2026-11-13T10:17:27.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.137","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L385"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L419"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L517"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/trunk"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791213/elisqlreports/trunk/index.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376eec5d-a629-4765-8ace-09e21bf3c2e8?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"NetScaler ADC","vendor":"Citrix","versions":[{"lessThan":"14.1-73.57","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-64.39","status":"affected","version":"0","versionType":"patch"},{"lessThan":"14.1-73.58 FIPS","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-37.293 FIPs and NDcPP","status":"affected","version":"0","versionType":"patch"}]},{"defaultStatus":"unaffected","product":"NetScaler Gateway","vendor":"Citrix","versions":[{"lessThan":"14.1-73.57","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-64.39","status":"affected","version":"0","versionType":"patch"}]}],"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway."}],"id":"CVE-2026-120864","lastModified":"2026-11-13T09:17:34.057","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","type":"Secondary"}]},"published":"2026-11-13T09:17:34.057","references":[{"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305"}],"sourceIdentifier":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","vulnStatus":"Received"}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"NetScaler ADC","vendor":"Citrix","versions":[{"lessThan":"14.1-73.57","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-64.39","status":"affected","version":"0","versionType":"patch"},{"lessThan":"14.1-73.58 FIPS","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-37.293 FIPs and NDcPP","status":"affected","version":"0","versionType":"patch"}]},{"defaultStatus":"unaffected","product":"NetScaler Gateway","vendor":"Citrix","versions":[{"lessThan":"14.1-73.57","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-64.39","status":"affected","version":"0","versionType":"patch"}]}],"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway."}],"id":"CVE-2026-120865","lastModified":"2026-11-13T09:17:34.190","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","type":"Secondary"}]},"published":"2026-11-13T09:17:34.190","references":[{"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305"}],"sourceIdentifier":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","vulnStatus":"Received"}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"NetScaler ADC","vendor":"Citrix","versions":[{"lessThan":"14.1-73.57","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-64.39","status":"affected","version":"0","versionType":"patch"},{"lessThan":"14.1-73.58 FIPS","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-37.293 FIPs and NDcPP","status":"affected","version":"0","versionType":"patch"}]},{"defaultStatus":"unaffected","product":"NetScaler Gateway","vendor":"Citrix","versions":[{"lessThan":"14.1-73.57","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-64.39","status":"affected","version":"0","versionType":"patch"}]}],"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory overflow / improper handling in BGP dynamic routing can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway."}],"id":"CVE-2026-120866","lastModified":"2026-11-13T09:17:34.313","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","type":"Secondary"}]},"published":"2026-11-13T09:17:34.313","references":[{"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305"}],"sourceIdentifier":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","vulnStatus":"Received"}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"NetScaler ADC","vendor":"Citrix","versions":[{"lessThan":"14.1-73.57","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-64.39","status":"affected","version":"0","versionType":"patch"},{"lessThan":"14.1-73.58 FIPS","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-37.293 FIPs and NDcPP","status":"affected","version":"0","versionType":"patch"}]},{"defaultStatus":"unaffected","product":"NetScaler Gateway","vendor":"Citrix","versions":[{"lessThan":"14.1-73.57","status":"affected","version":"0","versionType":"patch"},{"lessThan":"13.1-64.39","status":"affected","version":"0","versionType":"patch"}]}],"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory overflow in SSL/TLS/DTLS can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway."}],"id":"CVE-2026-120867","lastModified":"2026-11-13T09:17:34.437","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","type":"Secondary"}]},"published":"2026-11-13T09:17:34.437","references":[{"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305"}],"sourceIdentifier":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","vulnStatus":"Received"}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Customer Reviews for WooCommerce","vendor":"ivole","versions":[{"lessThanOrEqual":"5.127.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring."}],"id":"CVE-2026-121518","lastModified":"2026-11-13T10:17:27.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.300","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L26"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L407"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L584"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L159"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L175"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L24"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L284"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791702/"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791702/customer-reviews-woocommerce/trunk/includes/blocks/class-cr-all-reviews.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93acf29-8ff0-4412-9ff0-161f154b4311?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Newsletters","vendor":"contrid","versions":[{"lessThanOrEqual":"4.18.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the admin-controlled 'currentusersubscribed' option to be enabled and at least one page rendering the Newsletters subscribe shortcode or widget to exist; a Subscriber-level attacker can self-serve the attack by updating their own profile email to a crafted payload and loading such a page."}],"id":"CVE-2026-122063","lastModified":"2026-11-13T10:17:27.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.477","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/helpers/shortcode.php#L1416"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default/subscribe.php#L552"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default/widget.php#L12"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default2/subscribe.php#L571"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default2/widget.php#L12"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3794975/newsletters-lite/trunk/views/default/subscribe.php"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3794975%40newsletters-lite&new=3794975%40newsletters-lite"},{"source":"security@wordfence.com","url":"https://wordpress.org/plugins/newsletters-lite/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68348c03-d0ba-4dcc-8b18-a4675d6dce27?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Easy Property Listings","vendor":"mervb1","versions":[{"lessThanOrEqual":"3.5.28","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field() function is applied to the attribute value but does not escape single quotes, providing no mitigation against breaking out of the SQL IN('...') literal."}],"id":"CVE-2026-122227","lastModified":"2026-11-13T10:17:27.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.660","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L1851"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L1859"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L2349"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/shortcodes/shortcode-listing-search.php#L30"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/templates/content/shortcodes/listing-search/default.php#L119"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/widgets/widget-functions.php#L390"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.29"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0389e2-ab65-4652-a3e9-521dfd2e54a8?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SureDash – Community, Courses & Member Dashboard","vendor":"brainstormforce","versions":[{"lessThanOrEqual":"1.13.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role."}],"id":"CVE-2026-123769","lastModified":"2026-11-13T10:17:27.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.823","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/backend.php#L1309"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/social-logins.php#L472"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/services/router.php#L108"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/sanitizer.php#L101"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/settings.php#L604"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3794229/suredash/trunk/core/routers/backend.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f317dcd-dc4f-482a-8faa-91cd9c022276?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Drag and Drop File Upload for Elementor Forms","vendor":"addonsorg","versions":[{"lessThanOrEqual":"1.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the \"yeepdf_not_save\" privacy option is enabled, a commonly used production setting that triggers the remove_files() cleanup path."}],"id":"CVE-2026-124218","lastModified":"2026-11-13T10:17:28.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.993","references":[{"source":"security@wordfence.com","url":"https://downloads.wordpress.org/plugin/drag-and-drop-file-upload-for-elementor-forms.1.6.3.zip"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L724"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L764"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L838"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L849"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee73bfb0-843c-4b4a-b513-3980c1cefac1?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Chatterbug Forms – Fast, Flexible WordPress Form Builder","vendor":"sameh101","versions":[{"lessThanOrEqual":"1.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier."}],"id":"CVE-2026-125055","lastModified":"2026-11-13T10:17:28.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:28.153","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L308"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L331"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L422"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L510"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3794492/chatterbug-forms/trunk/chatterbug-forms.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7819c1fa-884b-4f1d-ba63-84057bf6da84?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Passster – Password Protect Pages and Content","vendor":"wpchill","versions":[{"lessThanOrEqual":"4.3.21","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passster_id | passster_headline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor can break out of the shortcode attribute context by embedding a ] character in the passster_id or passster_headline meta value to prematurely close the opening shortcode tag, then append a [/passster] closing tag so that the trailing HTML payload is emitted verbatim by do_shortcode() — bypassing the per-attribute escaping present inside render_shortcode() — and the script will also execute in an editor's or administrator's browser when they preview the Contributor's pending post, since filter_the_content() has no edit-permission capability gate."}],"id":"CVE-2026-125409","lastModified":"2026-11-13T10:17:28.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:28.317","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/admin/inc/class-ps-meta.php#L82"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L294"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L417"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L429"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3793918/content-protector/trunk/inc/class-ps-public.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81cf06d2-9b5a-4f9f-adf9-890b46db7783?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Recipe Card Blocks Lite","vendor":"wpzoom","versions":[{"lessThanOrEqual":"3.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post() preserves block-delimiter HTML comments verbatim on save, a Contributor can embed event-handler payloads inside the block's steps[].text attribute in a draft or pending post without the unfiltered_html capability, and the payload executes for any visitor — including privileged editors and administrators who preview or publish the post — as well as through the public print endpoint."}],"id":"CVE-2026-125948","lastModified":"2026-11-13T10:17:28.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:28.483","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L1999"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L184"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L63"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L90"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3794649/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-steps.php"},{"source":"security@wordfence.com","url":"https://wordpress.org/plugins/recipe-card-blocks-by-wpzoom/#developers"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed1f200-d4ae-4c9e-a618-fbeb58c0f3f3?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WPZOOM Addons for Elementor – Starter Templates & Widgets","vendor":"wpzoom","versions":[{"lessThanOrEqual":"1.4.20","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"id":"CVE-2026-126029","lastModified":"2026-11-13T10:17:28.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:28.657","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/frontend.js#L72"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L1057"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L1103"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L891"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3795911/wpzoom-elementor-addons/trunk/includes/widgets/world-map/world-map.php"},{"source":"security@wordfence.com","url":"https://wordpress.org/plugins/wpzoom-elementor-addons/#developers"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25b6009-0edb-4acd-97a3-c24e6e51fecc?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/siyuan","product":"siyuan","vendor":"siyuan-note","versions":[{"lessThan":"3.8.9","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.8.9","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets."}],"id":"CVE-2026-126264","lastModified":"2026-11-13T10:17:28.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:28.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/commit/d122dee55e8d3c77de313d0ad6efae8b6b0ebc07"},{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3pm7-cc76-7j2p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.9-sensitive-file-disclosure-via-api-file-getfile"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","product":"siyuan","vendor":"siyuan-note","versions":[{"lessThan":"3.8.9","status":"affected","version":"2.1.0","versionType":"semver"},{"status":"unaffected","version":"3.8.9","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session."}],"id":"CVE-2026-126265","lastModified":"2026-11-13T10:17:29.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.003","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-23g4-vqq8-5764"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.9-captcha-bypass-via-stale-login-cookie"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/SiYuan","product":"siyuan","vendor":"siyuan-note","versions":[{"lessThan":"3.8.9","status":"affected","version":"3.6.0","versionType":"semver"},{"status":"unaffected","version":"3.8.9","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field."}],"id":"CVE-2026-126266","lastModified":"2026-11-13T10:17:29.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qf37-w288-frvq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/siyuan-from-3.6.0-before-3.8.9-publish-password-bypass-via-getdoc-regex-keywords"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.04.4","status":"affected","version":"0.300.0","versionType":"custom"},{"status":"unaffected","version":"2026.04.4","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process."}],"id":"CVE-2026-126267","lastModified":"2026-11-13T10:17:29.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-gcxw-8q43-jhjc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-from-0.300.0-before-2026.04.4-denial-of-service-via-metaservice-logging"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter."}],"id":"CVE-2026-126268","lastModified":"2026-11-13T10:17:29.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.510","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-2rm5-wf7w-8j57"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-ip-address-spoofing-via-unconditional-proxy-trust"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.09.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.09.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims."}],"id":"CVE-2026-126269","lastModified":"2026-11-13T10:17:29.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.667","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-3f7w-wqf7-786q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-stored-xss-via-attachment-mime-type"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.09.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.09.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load."}],"id":"CVE-2026-126270","lastModified":"2026-11-13T10:17:29.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-5892-3964-gc52"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.1-unauthenticated-information-disclosure-via-aggregated-meta-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.09.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.09.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions."}],"id":"CVE-2026-126271","lastModified":"2026-11-13T10:17:29.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.987","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-rjc4-j36j-gjjc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-tls-private-key-exposure-via-data-source-read"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.09.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.09.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory."}],"id":"CVE-2026-126272","lastModified":"2026-11-13T10:17:30.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:30.140","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mmvm-m83w-6684"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-uncontrolled-resource-consumption-via-bulk-record-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.09.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.09.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control."}],"id":"CVE-2026-126273","lastModified":"2026-11-13T10:17:30.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:30.290","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mjxv-r6j7-m8gv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-privilege-escalation-via-incomplete-admin-bootstrap"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage."}],"id":"CVE-2026-126274","lastModified":"2026-11-13T10:17:30.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:30.440","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.09.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.09.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments."}],"id":"CVE-2026-126275","lastModified":"2026-11-13T10:17:30.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:30.583","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-x3xv-qpw2-33x6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-idor-in-row-comment-operations"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret."}],"id":"CVE-2026-126276","lastModified":"2026-11-13T10:17:30.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:30.733","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-4cx5-q9xx-5pgj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-client-authentication-bypass-via-oauth-token-exchange"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process."}],"id":"CVE-2026-126277","lastModified":"2026-11-13T10:17:30.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:30.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-2j2m-jqcx-2q2j"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-uncontrolled-resource-consumption-via-shared-view-bulk-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out."}],"id":"CVE-2026-126278","lastModified":"2026-11-13T10:17:31.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.053","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-7mf9-q77p-r4r3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-password-reset-token-race-condition"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.06.2","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.06.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victims open the field configuration, stealing the localStorage session token to call authenticated APIs as the victim."}],"id":"CVE-2026-126279","lastModified":"2026-11-13T10:17:31.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.210","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-j96w-qm45-vgp2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-stored-xss-via-ai-field-prompt-tooltip"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded."}],"id":"CVE-2026-126280","lastModified":"2026-11-13T10:17:31.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mh65-9xcf-vf8v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-refresh-token-reuse-via-non-atomic-rotation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own."}],"id":"CVE-2026-126281","lastModified":"2026-11-13T10:17:31.517","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.517","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-355h-p2mj-vwc9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-private-integration-credential-exposure-via-copy"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"2026.04.0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token."}],"id":"CVE-2026-126282","lastModified":"2026-11-13T10:17:31.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-jj94-6wwc-qhcx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-from-2026.04.0-before-2026.08.0-improper-privilege-management-via-organization-role-update"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later."}],"id":"CVE-2026-126283","lastModified":"2026-11-13T10:17:31.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.820","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-7395-6gh4-5q8p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-incorrect-authorization-via-base-scoped-api-tokens"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.07.0","status":"affected","version":"2026.05.2","versionType":"custom"},{"status":"unaffected","version":"2026.07.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses."}],"id":"CVE-2026-126284","lastModified":"2026-11-13T10:17:31.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.987","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-6q3f-6mpq-cqgc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-2026.05.2-before-2026.07.0-ssrf-via-data-import-url-fetch"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns."}],"id":"CVE-2026-126285","lastModified":"2026-11-13T10:17:32.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:32.140","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-f2jp-xg6f-hjf6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-sql-injection-via-legacy-where-query-filter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover."}],"id":"CVE-2026-126286","lastModified":"2026-11-13T10:17:32.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:32.287","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-x3wx-294c-4p48"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-reflected-xss-via-ncredirecturl-in-pageleavingwarning-vue"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.06.2","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.06.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection."}],"id":"CVE-2026-126287","lastModified":"2026-11-13T10:17:32.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:32.437","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-353r-pj87-54hc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-oauth-refresh-token-rotation-race-condition"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.06.2","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.06.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier."}],"id":"CVE-2026-126288","lastModified":"2026-11-13T10:17:32.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:32.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-rmx6-f46x-5hhx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-credential-disclosure-via-public-oauth-client-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.06.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.06.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands."}],"id":"CVE-2026-126289","lastModified":"2026-11-13T10:17:32.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:32.750","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-8wgf-24mr-w88q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-csv-formula-injection-via-export-service-ts"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1236"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.07.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.07.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials."}],"id":"CVE-2026-126290","lastModified":"2026-11-13T10:17:33.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:33.290","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-wxxj-mghf-33v4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.07.0-private-integration-credential-exposure-via-base-integration-read"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.06.2","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.06.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials."}],"id":"CVE-2026-126291","lastModified":"2026-11-13T10:17:33.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:33.443","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-8qgc-rxmx-p7cw"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-sql-injection-via-user-email-in-base-user-query"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.06.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.06.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking."}],"id":"CVE-2026-126292","lastModified":"2026-11-13T10:17:33.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:33.590","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-q5wf-7cr7-72h3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-password-hash-exposure-via-profile-update-response"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.06.2","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.06.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota."}],"id":"CVE-2026-126293","lastModified":"2026-11-13T10:17:33.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:33.740","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-cxj6-g54p-jwxp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-attachment-size-limit-bypass-via-upload-by-url"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"grav","vendor":"getgrav","versions":[{"lessThan":"3.11.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.11.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control."}],"id":"CVE-2026-126294","lastModified":"2026-11-13T10:17:34.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:33.890","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/getgrav/grav/security/advisories/GHSA-4x9h-4683-5fcx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/grav-login-plugin-before-3.11.0-two-factor-authentication-bypass-via-login"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"3.10.0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices."}],"id":"CVE-2026-126295","lastModified":"2026-11-13T10:17:34.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:34.060","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-arbitrary-file-read-via-bllipparser-model-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly."}],"id":"CVE-2026-126296","lastModified":"2026-11-13T10:17:34.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:34.243","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-59f9-gqg8-mqpj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-path-traversal-via-save-maxent-params-and-load-maxent-params"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes."}],"id":"CVE-2026-126297","lastModified":"2026-11-13T10:17:34.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:34.420","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-v8f3-6phw-6mh9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-cpu-denial-of-service-via-conllcorpusreader-srl-instances"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread."}],"id":"CVE-2026-126298","lastModified":"2026-11-13T10:17:34.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:34.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-r53h-rw34-8h97"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-cpu-denial-of-service-via-tree-chomsky-normal-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads."}],"id":"CVE-2026-126299","lastModified":"2026-11-13T10:17:34.877","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:34.747","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-89p3-fcch-88ph"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-time-denial-of-service-via-ccg-lexicon-fromstring"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"3.2.5","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability."}],"id":"CVE-2026-126300","lastModified":"2026-11-13T10:17:35.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:34.917","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-ffr9-mgrr-wcvr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-from-3.2.5-before-3.10.4-cpu-exhaustion-via-treebankwordtokenizer-span-tokenize"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"3.6","versionType":"custom"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components."}],"id":"CVE-2026-126301","lastModified":"2026-11-13T10:17:35.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:35.090","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-gpwc-27cw-rh9r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-from-3.6-before-3.10.4-quadratic-cpu-exhaustion-via-legalitysyllabletokenizer-tokenize"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"3.9.4","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox."}],"id":"CVE-2026-126302","lastModified":"2026-11-13T10:17:35.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:35.267","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-xmfg-f9cm-w86q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-3.9.4-before-3.10.4-symlink-sandbox-escape-via-chat80-sql-query"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools."}],"id":"CVE-2026-126303","lastModified":"2026-11-13T10:17:35.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:35.457","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-8fx7-8jr8-84rv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-denial-of-service-via-steppingrecursivedescentparser-parse"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"3.10.0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox."}],"id":"CVE-2026-126304","lastModified":"2026-11-13T10:17:35.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:35.637","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-qg35-44qx-7vrr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-symlink-escape-in-ycoecorpusreader"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"espocrm","vendor":"espocrm","versions":[{"lessThan":"10.0.9","status":"affected","version":"10.0.0","versionType":"semver"},{"status":"unaffected","version":"10.0.9","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"espocrm","vendor":"espocrm","versions":[{"lessThan":"9.3.11","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"9.3.11","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials."}],"id":"CVE-2026-126305","lastModified":"2026-11-13T10:17:35.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:35.797","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-j6q5-9jwj-9p8q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/espocrm-before-10.0.9-stored-xss-via-knowledge-base-article-attachments"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"espocrm","vendor":"espocrm","versions":[{"lessThan":"10.0.8","status":"affected","version":"10.0.0","versionType":"semver"},{"status":"unaffected","version":"10.0.8","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"espocrm","vendor":"espocrm","versions":[{"lessThan":"9.3.11","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"9.3.11","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator."}],"id":"CVE-2026-126306","lastModified":"2026-11-13T10:17:36.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:35.973","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-4qv5-q4g7-hp5r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/espocrm-before-10.0.8-stored-xss-via-malicious-svg-attachment"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/nezhahq/nezha","product":"nezha","vendor":"nezhahq","versions":[{"lessThan":"2.6.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.6.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests."}],"id":"CVE-2026-126307","lastModified":"2026-11-13T10:17:36.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:36.143","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nezhahq/nezha/commit/027bfcf6521f192635b946b7583c3ab39500ab98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nezhahq/nezha/commit/7cd0371b56f7bce83c3953b2bf4711b2105d5818"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nezhahq/nezha/security/advisories/GHSA-63mg-cxm4-98q3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nezha-dashboard-before-2.6.0-multiple-authorization-and-tenant-isolation-flaws"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.38.2","status":"affected","version":"2.38.0","versionType":"semver"},{"status":"unaffected","version":"2.38.2","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.37.6","status":"affected","version":"2.37.0","versionType":"semver"},{"status":"unaffected","version":"2.37.6","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.36.9","status":"affected","version":"2.36.0","versionType":"semver"},{"status":"unaffected","version":"2.36.9","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.34.14","status":"affected","version":"2.30.0","versionType":"semver"},{"status":"unaffected","version":"2.34.14","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.29.23","status":"affected","version":"2.24.0","versionType":"semver"},{"status":"unaffected","version":"2.29.23","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.36.0","status":"affected","version":"2.35.0","versionType":"semver"},{"status":"unaffected","version":"2.36.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination."}],"id":"CVE-2026-126308","lastModified":"2026-11-13T10:17:36.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:36.320","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coder/coder/security/advisories/GHSA-2x8w-q434-f76p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.2-session-token-leak-via-sub-agent-external-apps"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/openbao/openbao/v2","product":"openbao","vendor":"openbao","versions":[{"lessThan":"2.6.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.6.5","versionType":"semver"},{"lessThan":"2.7.2","status":"affected","version":"2.7.0","versionType":"semver"},{"status":"unaffected","version":"2.7.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names."}],"id":"CVE-2026-126309","lastModified":"2026-11-13T10:17:36.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:36.500","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openbao/openbao/security/advisories/GHSA-5pmx-2p74-x478"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-path-traversal-in-transit-key-import"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/openbao/openbao/v2","product":"openbao","vendor":"openbao","versions":[{"lessThan":"2.6.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.6.5","versionType":"semver"},{"lessThan":"2.7.2","status":"affected","version":"2.7.0","versionType":"semver"},{"status":"unaffected","version":"2.7.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret."}],"id":"CVE-2026-126310","lastModified":"2026-11-13T10:17:36.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:36.653","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openbao/openbao/security/advisories/GHSA-q824-44ff-f5j5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-oidc-provider-authentication-bypass-via-client-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
|
||||
Loaded 100 of 356 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user